Kalpesh Mistry 0 Posted October 3, 2019 Share Posted October 3, 2019 New Malware *.nesa cleaning required Link to comment Share on other sites More sharing options...
itman 1,740 Posted October 3, 2019 Share Posted October 3, 2019 (edited) Be as descriptive as possible in your postings. None on the forum are "mind readers." Appears you are referring to one of the most recent STOP ransomware variants. As such, this is not "new" malware: Quote The Nesa ransomware is distributed via spam email containing infected attachments or by exploiting vulnerabilities in the operating system and installed software. Cyber-criminals spam out an email, with forged header information, tricking you into believing that it is from a shipping company like DHL or FedEx. The email tells you that they tried to deliver a package to you, but failed for some reason. Sometimes the emails claim to be notifications of a shipment you have made. Either way, you can’t resist being curious as to what the email is referring to – and open the attached file (or click on a link embedded inside the email). And with that, your computer is infected with the Nesa ransomware. Nesa ransomware was also observed attacking victims by hacking open Remote Desktop Services (RDP) ports. The attackers scan for the systems running RDP (TCP port 3389) and then attempt to brute force the password for the systems. https://malwaretips.com/blogs/remove-nesa/ As noted in the malwaretips.com article, there is presently no decrypter available for this STOP ransomware variant. Are you stating that Eset failed to detect this variant? Edited October 3, 2019 by itman Link to comment Share on other sites More sharing options...
Recommended Posts