Beware of Fake Outlook Troubleshooting Calls that Ends Up In Ransomware Deployment

A sophisticated cyber threat has emerged in recent weeks, targeting unsuspecting users with fake Outlook troubleshooting calls.

These calls, designed to appear legitimate, ultimately lead to the deployment of ransomware on the victim’s system.

The scam involves a malicious binary named CITFIX#37.exe, which is masquerading as a legitimate tool derived from the Sysinternals Desktops utility.

Cybersecurity researchers at Deutsche Telekom CERT noted that the scam begins with a call from individuals claiming to be from Microsoft or another reputable tech company.

They assert that there is an issue with the user’s Outlook account and offer to troubleshoot the problem.

Once the user grants access to their computer, the attackers download and install the CITFIX#37.exe malware.

This binary is signed with fake digital certificates, making it appear legitimate at first glance.

Scam Details

The CITFIX#37.exe malware has a SHA256 hash of 247e6a648bb22d35095ba02ef4af8cfe0a4cdfa25271117414ff2e3a21021886.

Despite being signed, it is not authenticated by Microsoft. Instead, it uses malicious code signers such as Cascade Tech-Trek Inc., AM MISBAH Tech Inc., and KouisMoa MegaByte Information Technology Co., Ltd.

The malware installation process show how the attackers use these fake certificates to deceive users into trusting the software.

Once installed, the malware can lead to ransomware deployment, encrypting the user’s files and demanding payment in exchange for the decryption key.

To protect yourself from fake Outlook troubleshooting scams, always verify the caller’s identity, as legitimate companies like Microsoft will not contact you unexpectedly for issue resolution.

Be cautious about granting remote access to your computer unless you are absolutely certain of the caller’s authenticity.

Keeping your antivirus software up to date ensures better protection against emerging threats, while regularly backing up your data can help prevent loss in case of an attack.

By understanding how these attacks work and following best security practices, individuals can significantly reduce their risk of falling victim to ransomware and other malicious schemes.

Indicators of Compromise (IoCs)

• File Name: CITFIX#37.exe
• SHA256 Hash: 247e6a648bb22d35095ba02ef4af8cfe0a4cdfa25271117414ff2e3a21021886
• Malicious Signers:
• Cascade Tech-Trek Inc.
• AM MISBAH Tech Inc.
• KouisMoa MegaByte Information Technology Co., Ltd.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free