Custom Ransomware Campaign Impersonates Interpol to Target SMBs

The global cybersecurity landscape is defined by an ongoing arms race between increasingly sophisticated defensive technologies and ever-evolving threat vectors. Historically, the most disruptive cyberattacks have relied on advanced evasion techniques, zero-day vulnerabilities, or complex supply chain compromises. However, a newly identified global phishing campaign demonstrates that threat actors do not always need sophisticated software engineering to bypass corporate defenses. By combining psychologically intense social engineering with basic malware, attackers are successfully breaching organizations worldwide.

Uncovered by researchers at the Bitdefender Antispam Lab, this campaign targets small and medium-sized businesses (SMBs) across Europe, Asia, North America, and the Middle East. Attackers are impersonating the “Cybercrime Investigation Unit” at Interpol to pressure victims into downloading and running a highly damaging payload. Ironically, while the social engineering framework is remarkably polished, the campaign’s deployment of custom ransomware suffers from a catastrophic, self-defeating implementation flaw: the developers embedded the decryption logic and the corresponding key directly within the malware’s own binary code. This critical error allows impacted organizations to reverse-engineer the malware and fully recover their files without communicating with or paying the extortionists.

The Social Engineering Engine: Exploiting Authority and Fear

The primary vector of this campaign is not a highly technical exploit, but rather an acute psychological attack. Cybercriminals understand that the human element remains the most vulnerable layer in any organization’s security posture. By impersonating a global law enforcement body like Interpol, they instantly establish a position of absolute authority.

The attack begins with an official-looking email carefully formatted with Interpol branding, formal legal terminology, and authoritative language. The messages claim that the recipient’s organization has been flagged in connection with an ongoing investigation into “suspicious, fraudulent, or non-compliant activities.” To heighten the target’s cognitive load and bypass standard rational skepticism, the email is framed as an “emergency compliance response” requiring immediate action.

To make the threat feel real and urgent, the email alleges that investigators have gathered extensive digital evidence, including “video recordings,” documenting the company’s unauthorized activity. To resolve the matter, the recipient is instructed to urgently review this evidence via a Proton Drive link provided in the body of the message. For an SMB employee or business owner, the sudden threat of legal action, public exposure, or regulatory penalties triggers immediate panic, making them far more likely to bypass standard verification protocols and click the link.

Why SMBs Are the Ideal Targets

While large enterprises often have robust legal teams and designated security operations centers (SOCs) to vet unsolicited communications from law enforcement, SMBs rarely possess these resources. A business owner, HR administrator, or IT generalist at a mid-sized firm is more likely to handle such high-stakes notices themselves. The lack of a formalized compliance hierarchy—combined with the fear of corporate liability—makes SMBs uniquely susceptible to authority-based social engineering.

The Phishing Chain: Bypassing the Secure Email Gateway (SEG)

The delivery mechanics of this campaign highlight a calculated strategy designed to bypass modern Secure Email Gateways (SEGs) and automated sandbox environments. Rather than attaching a malicious executable directly to the email—which would immediately trigger signature-based blocks or heuristic warnings—the attackers utilize a multi-stage delivery chain.

1. Hosting on Legitimate Cloud Infrastructure

The attackers host their malicious payload on Proton Drive, a highly secure, privacy-focused, and legitimate cloud storage service. Because Proton Drive is a trusted domain with high global reputation scores, automated web filters and secure gateway scanners do not flag the link as inherently malicious. This allows the phishing email to comfortably slip through domain-reputation-based filters.

2. Password-Protected Archive Encryption

The link leads the user to download a password-protected archive (typically formatted as archive.rar). By password-protecting the file, the attackers ensure that automated email scanners and cloud sandboxes cannot decrypt the archive, inspect its contents, or execute static analysis. The password to open the file is conveniently provided in the plain text of the email. While a human user can effortlessly read the password and paste it into their decompression software, automated defensive systems struggle to dynamically correlate unstructured plain-text passwords from an email body with an encrypted attachment link in real time.

3. Archive Nesting and Double Extensions

Within the downloaded archive.rar file, the attackers implement a technique known as archive nesting. The payload is buried under multiple nested archive layers to further confuse and exhaust automated scanning tools. At the center of these layers sits an executable file that uses double extensions or generic media icons to disguise itself as a harmless video file. For example, the file might appear as Evidence_Video.mp4.exe, relying on the fact that default Windows settings frequently hide known file extensions, leaving the user to see only the trusted “.mp4” and a standard media player icon.

Anatomy of the Payload: Crux of the Custom Ransomware

When the victim attempts to play the “video,” they double-click the executable. Instead of launching a media player, this action triggers the installation and execution of a unique, custom ransomware strain. According to Bitdefender Senior Security Researcher Viorel Vrabie and security analyst Andrei Mogage, the malware was likely constructed using publicly available code templates, online coding tutorials, or AI-assisted coding tools. This indicates that the developers did not build the threat from scratch, but rather compiled pre-existing logic into a custom executable.

Once active on the system, the ransomware behaves in the following manner:

• Local & Network Drive Mapping: It scans the infected system to identify all available local drives, external drives, and network-mapped shares.
• Targeted File Encryption: It systematically traverses directories, targeting specific file extensions (such as databases, documents, spreadsheets, and media files) and locking them using a custom encryption algorithm.
• No Data Exfiltration: Unlike modern high-tier ransomware operations that utilize double-extortion tactics (stealing data before encrypting it), Bitdefender’s analysis confirmed that this custom payload lacks exfiltration capabilities. It is strictly designed for local encryption.

The Negotiation Model: Why Tox Over Dark Web Portals?

After locking the target’s files, the malware drops a ransom note onto the desktop. Interestingly, the note does not specify a concrete ransom amount. Instead, it instructs the victim to contact the attackers via Tox, a secure, end-to-end encrypted peer-to-peer messaging protocol.

This “negotiate-first” strategy serves two distinct purposes for the threat actors:

1. Dynamic Sizing: Rather than demanding a flat rate that might be too high for a small business to pay (leading them to abandon recovery) or too low for a wealthier target, the attackers can dynamically assess the victim’s size, financial desperation, and industry vertical before setting a price.
2. Infrastructure Simplification: Operating a dedicated Tor (.onion) negotiation portal requires significant technical overhead, continuous server maintenance, and robust security to avoid takedowns by law enforcement. By routing communications through a basic Tox ID, the attackers eliminate the need for infrastructure hosting, relying on a free, decentralized chat platform.

The Fatal Cryptographic Flaw: Embedded Decryption Keys

The defining element of this campaign is not its delivery mechanism, but the severe developmental error embedded within the payload. While professional ransomware gangs use asymmetric encryption (like RSA or Curve25519) to securely lock symmetric encryption keys, these amateur operators failed to implement secure key management.

During deep-dive binary analysis, Bitdefender’s research team made a startling discovery: the threat actors hardcoded both the decryption logic and the actual static decryption key directly into the malware’s binary code.

In a standard, securely designed cryptographic attack, the encryption key is generated dynamically on the victim’s machine, encrypted using the attacker’s public key, and then sent back to the command-and-control (C2) server. Decryption is impossible without the attacker’s private key, which never leaves their possession. In this campaign, because the developers utilized a static, hardcoded symmetric key and compiled the decryption function within the executable itself, the entire cryptographic scheme collapses.

As a result, impacted businesses do not need to contact the extortionists or pay a single dollar. A skilled malware analyst or security engineer can open the binary in a decompiler, locate the hardcoded key strings and recovery functions, and write a localized decryption tool to reverse-engineer the files. Bitdefender’s confirmation of this vulnerability provides immediate relief to any business currently locked out of its systems by this specific “Interpol” campaign.

The Cyber Insurance and SMB Risk Landscape

This campaign highlights a broader shift in the threat landscape that cyber underwriters and security practitioners are watching closely. The availability of modular, copy-and-paste malware templates, alongside generative AI coding assistants, has democratized the creation of ransomware. Individuals with very little coding capability can now deploy disruptive ransomware campaigns.

Even though the malware itself is fundamentally flawed, the initial operational impact can still be devastating. Before a company realizes they can decrypt their files for free, they may experience business interruption, lost productivity, and the panic of a perceived catastrophic breach. This makes robust endpoint protection, offline backups, and employee security awareness training more critical than ever.

Defensive Strategies and Remediation Protocols

To defend against authority-impersonation phishing and avoid the disruption of custom ransomware infections, organizations should implement the following security measures:

• Implement “Second-Opinion” Content Filtering: Configure secure email gateways to aggressively flag or quarantine incoming emails containing links to public cloud storage platforms (like Proton Drive, Google Drive, or OneDrive) when they originate from external, unverified senders.
• Enforce Strict File Extension Visibility: Ensure that Windows Group Policy Objects (GPOs) are configured to disable the “Hide extensions for known file types” setting across all corporate endpoints. This prevents users from mistaking a malicious .exe file for a .mp4 or .pdf document.
• Verify Law Enforcement Communications: Establish clear protocol guidelines stating that legitimate international law enforcement agencies like Interpol, Europol, or local police departments do not send unsolicited, informal emails requesting the download of password-protected files to review “evidence”. Any such communication should be treated as a threat until verified through official channels.
• Deploy Behavioral Endpoint Detection and Response (EDR): Utilize modern EDR platforms that detect and block the behavioral patterns of ransomware (such as rapid, unauthorized file-renaming and encryption processes), rather than relying solely on static signature detection.
• Isolate and Analyze Prior to Decryption: If an organization falls victim to this specific campaign, isolate the affected machines immediately to prevent network propagation. Do not pay the ransom. Consult a professional incident response firm or use a reputable malware analysis tool to safely extract the hardcoded decryption key and restore the encrypted volumes.

Ultimately, while this campaign serves as a stark reminder of the power of psychological manipulation in modern phishing, its technical execution proves that cybercriminals are just as prone to developer error as legitimate software engineers. By maintaining a calm, analytical approach to security incidents, SMBs can successfully thwart these threats and protect their digital assets.