My Resume Protects All Your Files
Summary: Cisco Talos reported a spam campaign that disguises a 276-byte zip file as a resume, sometimes made to look like a reply to an existing email, and uses the HTML file inside to redirect victims through a compromised WordPress site and an iframe to a Google Drive download. That download, named my_resume_pdf.zip, contains a .scr file that drops Cryptowall 3.0 when executed, and Talos said analysis of the malicious URL showed a large number of recipients attempting to download the file from the compromised WordPress site.
Key Takeaway: The layered redirection lets the attacker change the payload by swapping nothing more than the file stored on Google Drive, so the same email and links can deliver new malware without a new campaign. Talos also notes that paying the ransom encourages more development and does not guarantee removal of the infection.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026