What’s happened?
The FBI has published a warning about a ransomware gang called the OnePercent Group, which has been attacking U.S. companies since November 2020.
How are companies being attacked by the OnePercent gang?
The gang emails targeted individuals inside an organization using social engineering tricks to dupe the unwary into opening a malicious Word document contained within an attached ZIP file.
And the attachment encrypts data on the user’s PC?
Not quite. Macros embedded within the document install a modular banking Trojan horse known as IcedID onto the victim’s computer.
IcedID (also sometimes known as BokBot) can steal login credentials for financial institutions as users attempt to access their online bank accounts, but it can also download and drop other malware. One imagines IcedID was deliberately expanded in this fashion to make it more lucrative for cybercriminals.