<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(0,0,0)">Listers,<br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(0,0,0)">I'm not sure if you have heard of this ransom-ware called 'Locky'. I'm forwarding this email FYI, its important not to open any attachments with executable files especially if they are unsolicited emails.<br></div><div class="gmail_quote"><br><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(0,0,0)">Locky is the worst because the only way out if you don't have backups stored elsewhere you are forced to pay a ransom.<br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(0,0,0)"><a href="http://www.symantec.com/connect/blogs/locky-ransomware-aggressive-hunt-victims">http://www.symantec.com/connect/blogs/locky-ransomware-aggressive-hunt-victims</a><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(0,0,0)"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(0,0,0)">Regards<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(0,0,0)">Rop<br></div><br>---------- Forwarded message ----------<br>From: <b class="gmail_sendername"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(0,0,0);display:inline"></div>Wisdom Donkor</b> <span dir="ltr"><<a href="mailto:wisdom.dk@gmail.com">wisdom.dk@gmail.com</a>></span><br>Date: Thu, Mar 24, 2016 at 11:52 AM<br>Subject: [governance] RANSOMWARE BY NAME LOCKY.<br><br><br><div dir="ltr"><div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px"><span style="font-family:"trebuchet ms",sans-serif">Dear All,</span></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px"><span style="font-family:"trebuchet ms",sans-serif">Yesterday at <span><span>2:38pm</span></span> an employee in one of the organisation in Ghana was attacked by ransomware by name locky, this ransomware was sent in an email with an attachment , the attachment contained an ms-word document with a malicious macro, the locky program was activated when the user clicked "enable editing " after the document was opened, this macro begun an encryption process using a RSA-2048 and AES-128 algorithm, the encryption process targeted the following file extensions *.docx;*.pdf;*.pptx;*.xlsx;*.doc</span></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px"><span style="font-family:"trebuchet ms",sans-serif"><br></span></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px"><span style="font-family:"trebuchet ms",sans-serif">Yesterday Three US hospitals were hit by "locky" as well,The IT systems of Kentucky Methodist Hospital and Chino Valley Medical Center and Desert Valley Hospital, California, were infected with this ransomware,</span></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px"><font face="trebuchet ms, sans-serif">The files cannot be recovered unless the victim has an offline backup to recover from or pays a ransom with bitcoins via the darkweb,the attackers promise to send the private key in a compiled program to decrypt the victim's files after they receive payment.</font></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px"><span style="font-family:"trebuchet ms",sans-serif">System restore cannot restore files just settings so it will not help in this case.</span></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px"><span style="font-family:"trebuchet ms",sans-serif"><br></span></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px"><font face="trebuchet ms, sans-serif">Third-party recovery software cannot recover the encrypted files because the files are not considered as deleted. </font><span style="font-family:"trebuchet ms",sans-serif">The previous ransomware by name "cryptolocker" did not rename the files it encrypted so it was possible to recover your files by using the windows "previous version" feature, however "locky" renames all the files it encrypts so that windows cannot index the file's shadow copies to recover them.</span></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px"><span style="font-family:"trebuchet ms",sans-serif"><br></span></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px"><span style="font-family:"trebuchet ms",sans-serif">CERT-GHANA recommends that all users open email attachments with caution especially executable files. </span></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px"><br></div><div style="color:rgb(0,0,0);font-size:16px"><font face="trebuchet ms, sans-serif">Cheers,</font><img src="https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif" style="font-family: "times new roman","new york",times,serif;"></div></div><div><br></div><div><br></div><div><br></div><div><br></div><br clear="all"><div><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div><div><div><div><div dir="ltr"><div><div dir="ltr"><div><div style="font-size:small"><b>WISDOM DONKOR (S/N Eng.)</b><br></div><div style="font-size:small">ICANN Fellow / ISOC Member, IGF Member, Diplo Foundation<br>OGP Working Group Member, Africa OD Working Group Member<br></div><span style="font-size:small">E-government and Open Government Data Platforms Specialist<br></span></div><div><div style="font-size:small"><div>National Information Technology Agency (NITA) <br></div><div>Ghana Open Data Initiative (GODI)</div><div>Post Office Box CT. 2439, Cantonments, Accra, Ghana</div><div>Tel; +233 20 812881</div><div>Email: <a href="mailto:wisdom_dk@hotmail.com" style="color:rgb(17,85,204)" target="_blank">wisdom_dk@hotmail.com</a><br></div><div><a href="mailto:wisdom.donkor@data.gov.gh" style="color:rgb(17,85,204)" target="_blank">wisdom.donkor@data.gov.gh</a><br></div><div><a href="mailto:wisdom.dk@gmail.com" style="color:rgb(17,85,204)" target="_blank">wisdom.dk@gmail.com</a><br></div><div>Skype: wisdom_dk</div><div>facebook: facebook@wisdom_dk<br></div><div>Website: <a href="http://www.nita.gov.gh/" style="color:rgb(17,85,204)" target="_blank">www.nita.gov.gh</a> / <a href="http://www.data.gov.gh/" style="color:rgb(17,85,204)" target="_blank">www.data.gov.gh</a><br></div><div><a href="http://www.isoc.gh/" style="color:rgb(17,85,204)" target="_blank">www.isoc.gh</a> / <a href="http://www.itag.org.gh/" style="color:rgb(17,85,204)" target="_blank">www.itag.org.gh</a></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
<br>____________________________________________________________<br>
You received this message as a subscriber on the list:<br>
<a href="mailto:governance@lists.igcaucus.org">governance@lists.igcaucus.org</a><br>
To be removed from the list, visit:<br>
<a href="http://www.igcaucus.org/unsubscribing" rel="noreferrer" target="_blank">http://www.igcaucus.org/unsubscribing</a><br>
<br>
For all other list information and functions, see:<br>
<a href="http://lists.igcaucus.org/info/governance" rel="noreferrer" target="_blank">http://lists.igcaucus.org/info/governance</a><br>
To edit your profile and to find the IGC's charter, see:<br>
<a href="http://www.igcaucus.org/" rel="noreferrer" target="_blank">http://www.igcaucus.org/</a><br>
<br>
Translate this email: <a href="http://translate.google.com/translate_t" rel="noreferrer" target="_blank">http://translate.google.com/translate_t</a><br>
<br></div><br></div>