Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Summary: On April 11, 2017, Unit 42 observed a USPS-themed spam campaign that redirected victims to fake Microsoft Word Online sites pushing a new CryptoMix-family ransomware called Mole, which appends .MOLE to encrypted files. The campaign changed tactics within days: by April 13 it delivered a plugin.zip containing a Nemucod .js downloader that installed Mole, Kovter and Miuref, and by April 14 it dropped the redirect and linked directly to the fake Word site.
Key Takeaway: This campaign reworked its delivery chain three times in four days, then by April 18 had swapped Mole for the KINS banking Trojan and by April 21 moved to speeding-ticket lures and a fake parking services site - a pace of change that signature-based detection tuned to one email theme or file type would miss.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026