Cybercriminals Pose as Interpol in Phishing Emails to Infect Victims With Ransomware

Cybercriminals are conducting a multi-region phishing campaign impersonating Interpol to trick small businesses into downloading a password-protected Proton Drive file that contains an executable disguised as a video which installs a relatively simple, custom-built ransomware; victims are then instructed to contact the attackers via the Tox messaging service. Bitdefender advises verifying unsolicited correspondence and avoiding opening suspicious Proton Drive links, noting law enforcement would not normally send such files by email.