Your Files Are Encrypted with a "Windows 10 Upgrade"
Summary: Cisco Talos discovered a spam campaign impersonating Microsoft that exploited the July 29 release of Windows 10 as a free upgrade, luring users to open an attachment that delivered the CTB-Locker ransomware. The email originated from IP space allocated to Thailand, mimicked Microsoft's color scheme, included a fake antivirus-scanned notice, and used elliptical curve encryption, a 96-hour payment window, and hard-coded IPs on non-standard ports including 9001, 443, 1443, 666 and 21 for command and control.
Bottom line: CTB-Locker gave victims only 96 hours to pay, and its C2 traffic ran over port 21 and other ports likely allowed outbound, so a network that trusts FTP traffic would not see the infection.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026