Loading story…
Cybercriminals have been sending phishing emails that impersonate Interpol and other international law-enforcement bodies to trick recipients into installing ransomware. The messages, framed as notices from an alleged “Cybercrime Investigation Unit,” accuse targets of suspicious or fraudulent activity and pressure them to review supposed evidence. Reports indicate the campaign has targeted small businesses across Europe, Asia, the Middle East, and North America, using fear and urgency to drive victims to open attacker-controlled files.
The emails direct recipients to a password-protected archive hosted on Proton Drive, where the lure file is presented as evidence but ultimately leads to an executable disguised as a video. Once launched, the malware encrypts systems and drops a ransom note instructing victims to contact the operators via Tox rather than pay a fixed amount, indicating case-by-case extortion. Researchers said the payload appears to be a simple custom-built ransomware strain that does not match known families and relies on hardcoded values instead of more advanced infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Bitdefender Antispam Lab published a blog post describing a phishing campaign that impersonates Interpol’s “Cybercrime Investigation Unit” and other law-enforcement themes to deliver ransomware via a password-protected Proton Drive file. The campaign targeted small businesses across Europe, Asia, the Middle East, and North America, and the payload was described as a simple custom-built ransomware sample using hardcoded values.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Small businesses across the United States, Europe, Asia, and the Middle East have been targeted with phishing emails impersonating the **“Interpol Cybercrime Investigation Unit”** and claiming the recipient is tied to an investigation. The messages use fear-based social engineering to push victims to a Proton Drive link hosting a password-protected archive, which contains multiple nested archives and a custom ransomware payload disguised as a video file. Bitdefender said the campaign has hit organizations in food and agriculture, legal services, pharmaceuticals, media, technology, and finance. Once launched, the malware encrypts files on available drives and drops a ransom note directing victims to contact the attackers through **Tox** instead of a leak site or negotiation portal. Researchers found no evidence of data exfiltration and said the operation appears to be the work of a less sophisticated actor rather than an established ransomware group. Bitdefender also identified a major implementation flaw: the decryption routine and key are embedded in the payload, allowing victims to recover files without paying, while defenders were urged to isolate infected systems, scan endpoints, maintain backups, train employees, and enable visible Windows file extensions.
Jul 2, 2026
The **Silent Ransom Group** — also tracked as **UNC3753**, **Luna Moth**, and **Chatty Spider** — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels. Authorities said the campaign has escalated beyond remote access attempts to **in-person intrusions**, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including `business-data-leaks[.]com` and `ep6pheij[.]com`. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Jun 29, 2026
Sophos reported that the Interlock ransomware group, also tracked as **GOLD EMBRACE**, used legitimate memory-forensics tools including **WinPmem** and **Volatility3** to steal Windows credentials during a March 2026 intrusion. The attack began with a **ClickFix** social-engineering lure on a compromised website after a user searched for Dynamics 365 via ChatGPT and was tricked into pasting a malicious command. That command downloaded PowerShell code and installed a remote-access payload on an unprotected Windows 10 endpoint, giving the attackers an initial foothold. Over roughly 26 hours, the attackers conducted LDAP discovery, privilege escalation, **Kerberoasting**, and NTLM downgrade-based lateral movement before reaching a domain controller. Sophos said Interlock used the forensic tools to extract NTLM and LM hashes, local account data, cached domain credentials, and other secrets, then created new domain-admin accounts, established persistence with a scheduled task and `node.exe`, tampered with Microsoft Defender, exfiltrated sensitive data including AWS credentials, and ultimately deployed ransomware that locked the victim out of hypervisors. The campaign reflects Interlock’s broader double-extortion operations against organizations in North America and Europe, including critical infrastructure, healthcare, and education, and its use of malware such as **NodeSnake** and **InterlockRAT**.
Aug 10, 2026