VERY IMPORTANT

The LookingGlass Cyber Threat Intelligence Group (CTIG) observed a widespread malspam campaign sent to victims appearing as if it had been an email to themselves with a malicious attachment. The attachment in this campaign is a malicious zip file containing malicious obfuscated JavaScript. Upon running the JavaScript, the Locky ransomware is downloaded and executed. Sinkhole data explained below shows just how quickly this campaign is impacting victims.