Office 365 hit by Cerber ransomware attack

Highlighted by Stockport based Cloud 9 Hosts, the attack warning comes from US security specialists Avanan whose Cloud Security Platform detected a Cerber ransomware attack against its customers that were using Office 365.

Avanan’s Steven Toole blogged about the Cerber ransomware virus attack against Office 365 corporate users, and said that millions are likely to have been impacted: “Starting on June 22^nd, the attack included a Cerber ransomware virus, which was spread through email and encrypted users’ files. Once encrypted, Cerber demanded a ransom be paid in order to regain access to the user’s documents, photos and files.”

The virus played an audio file warning that the computer’s files have been locked.

Microsoft has taken note of Avanan’s analysis, detected the attack and began blocking the offending attachment.  

Graham Saul, managing director of Cloud 9 Hosts explains the difference between public and private cloud based computing systems:

“Widely used, Office 365 is cloud based software and runs on a public platform. That is why so many Users can be infected through one account.

“Services that are provided through private cloud based computing systems are less vulnerable and less likely to suffer from such an attack. Each private cloud based clients email, data servers and virtual desktops are being placed in their own dedicated silo. The risk of one client’s problem contaminating any other client is zero.”

A Microsoft spokesperson, in an email to SCMagazine.com, offered up a slightly different timeline on how quickly the issued was spotted and addressed:

“Office 365 malware protection identified the attack and was updated to block it within hours of its origination on June 22. Our investigations have found that this attack is not specific to Office 365 and only a small percentage of Office 365 customers were targeted, all of which have been protected,” the spokesperson said.

In a unique twist, the ransom note was accompanied by an audio file explaining the attack and how to regain access to the files. The attacker asked for a ransom totalling 1.4 bitcoin, or about $500, for the decryption key.