{"id":46790,"date":"2016-01-05T16:30:18","date_gmt":"2016-01-06T00:30:18","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=46790"},"modified":"2025-06-03T01:25:31","modified_gmt":"2025-06-03T08:25:31","slug":"new-teslacrypt-ransomware-arrives-via-spam","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/","title":{"rendered":"New TeslaCrypt Ransomware Arrives via Spam"},"content":{"rendered":"

During the last couple of weeks, McAfee Labs has observed a huge increase in spam related to Nemucod, a malicious JavaScript that usually arrives as a .zip attachment and tries to download other malware. Nemucod is known to download threats such as\u00a0Fareit, CryptoWall, and others. However, we have now observed that Nemucod is downloading new variants of TeslaCrypt, a file-encrypting ransomware discovered in early 2015.<\/p>\n

Initially, TeslaCrypt infected systems from a compromised website, using AES encryption and demanding a ransom to decrypt the files. It redirects victims to a site running the\u00a0Angler exploit kit<\/a>. (For more on Angler, read the\u00a0McAfee Labs Threats Report,<\/em>\u00a0February 2015)<\/em>. McAfee Labs blogged about that variant <\/a>in March 2015.<\/p>\n

As expected, the attackers have now come up with a new twist to step up TeslaCrypt infections through\u00a0a very strong spam campaign.\u00a0<\/strong>The attackers are consistently offering more sophisticated malware and social engineering techniques to distribute it. As a consequence, TeslaCrypt has become one of the most prevalent and hazardous threats in circulation.<\/p>\n

Nemucod’s spam campaign<\/strong><\/h2>\n

The new spam campaign contains a .zip file as an attachment. The .zip contains a malicious JavaScript file to evade detection from some email scanners and maximize its outreach. The contents of the email are carefully crafted to lure victims\u00a0using social engineering techniques.<\/p>\n

\"Dec2015Tesla-zip<\/p>\n

The contents of the JavaScript\u00a0file are highly obfuscated and contain a lot of junk code.<\/p>\n

\"Dec2015Tesla-obfuscated<\/p>\n

After deobfuscating the contents, the\u00a0code tries to download an executable from whatdidyaysay.com or iamthewinnerhere.com and stores it in the %TEMP% location.<\/p>\n

\"Dec2015Tesla-deobfuscatedJS\"<\/p>\n

After Nemucod comes W97M downloader<\/strong><\/h2>\n

Just one week after Nemucod, we saw new variants of W97M\/Downloader also downloading Teslacrypt. The spam email contains a document file attachment or a .zip attachment containing a document file. Using a fake invoice, attackers try to convince users into opening an attached .doc file.<\/p>\n

\"Dec2015Tesla-doc<\/p>\n

To an unsuspecting user this email\u00a0looks like a legitimate urgent notice about an unpaid invoice, but after taking a closer look we realize it could be a phishing email. The macro code inside attached .doc looks like this:<\/p>\n

\"Dec2015Tesla-extracted<\/p>\n

Looking into the new TeslaCrypt<\/strong><\/h2>\n

The new variant is TeslaCrypt Version 2.2.0. This version encrypts users’ files and appends the filenames with a .vvv extension. The file extension changes regularly. (The previous version of TeslaCrypt used the file extension .ccc.) TeslaCrypt encrypts files using RSA-4096. The malware also drops two files on the victim\u2019s machine\u2014one plain-text file and an HTML file\u2014containing instructions on how to pay the ransom and receive a decryption key. The ransom message instructs the victim to install the anonymous Tor web browser and visit a Tor website for further instructions.<\/p>\n

Let’s dig into the\u00a0code to understand more about this new version. Upon execution, TeslaCrypt\u00a0drops and executes a copy in %AppData% directory and deletes itself.<\/p>\n

\"Dec2015Tesla-dropcopy\"<\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

To ensure only one instance is running, the malware\u00a0creates a mutex as “2134-1234-1324-2134-1324-2134.”<\/p>\n

\"Dec2015Tesla-Mutex\"<\/p>\n

It then sets the EnableLinkedConnections registry to force Windows to automatically make the network drives available to both the standard and administrator accounts. This way, this ransom will be able to search and encrypt files on network drives and shares without any issues.<\/p>\n

\"Dec2015Tesla-RegEnableLinks\"<\/p>\n

The malware\u00a0also creates an autostart registry entry to make sure its copy will be executed upon rebooting.<\/p>\n

\"Dec2015Tesla-RegAutoStart\"<\/p>\n

As with old TeslaCrypt variants, the new one removes the volume shadow copies from the target’s system, thereby preventing\u00a0the user from restoring the encrypted files. (Shadow copy is a technology in Windows that helps users make backup copies (snapshots) of computer files or volumes.) To delete the shadow volume copies, TeslaCrypt uses the command “vssadmin.exe Delete Shadows \/All \/Quiet.” This ransomware uses the vssadmin.exe utility to quietly delete all the shadow volume copies on the computer.<\/p>\n

\"Dec2015Tesla-vssadmin\"<\/p>\n

TeslaCrypt\u00a0next\u00a0changes boot configuration data (BCD) by using\u00a0its command-line tool (bcdedit.exe) to disable some features, so victims\u00a0will have a hard time restoring or recovering encrypted files. BCD is a firmware-independent database for boot-time configuration data. It performs the following:<\/p>\n

    \n
  • Disables Emergency Management Services (EMS).<\/li>\n
  • Disables the edit and advanced boot options\u00a0at startup.<\/li>\n
  • Disables Windows startup repair and error recovery.<\/li>\n<\/ul>\n

    \"Dec2015Tesla-bcdedit\"<\/p>\n

    The remote server and configuration details are all encrypted in its body. The ransomware decrypts them first before attempting to connect to them. The following are the decrypted remote URLs found on the sample we analyzed:<\/p>\n

      \n
    • http:\/\/atendercrumb.com\/wp-content\/plugins\/theme-check\/misc.php<\/li>\n
    • http:\/\/aumentopenis.org\/wp-content\/plugins\/theme-check\/misc.php<\/li>\n
    • http:\/\/apiercephoto.com\/wp-content\/plugins\/theme-check\/misc.php<\/li>\n
    • http:\/\/austinberean.com\/wp-content\/plugins\/theme-check\/misc.php<\/li>\n
    • http:\/\/attlecostumiers.com\/wp-content\/plugins\/theme-check\/misc.php<\/li>\n
    • http:\/\/athomegirl.com\/wp-content\/plugins\/theme-check\/misc.php<\/li>\n<\/ul>\n
      \"Dec2015Tesla-Cnc\"<\/div>\n

      This ransomware\u00a0created three malicious threads to perform the following:<\/p>\n

        \n
      • Connect to a remote server.\u00a0It also uses “http:\/\/myexternalip.com\/raw” to get the user’s external IP.<\/li>\n<\/ul>\n
        \"Dec2015Tesla-checkCnC\"<\/div>\n
        <\/div>\n
          \n
        • Terminate processes containing the following strings:\n
            \n
          • “askmg”: task manager process, taskmgr.ex.<\/li>\n
          • “rocex”: process explorer, processxp.exe.<\/li>\n
          • “egedit”: registry editor, regedit.exe.<\/li>\n
          • “sconfi”: system configuration, msconfig.exe.<\/li>\n
          • “cmd”: command-line tool, cmd.exe.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
            \"Dec2015Tesla-terminate\"<\/div>\n
              \n
            • Enumerate logical\/network drives and shares, and encrypt files.<\/li>\n<\/ul>\n

              The malware starts by calling the GetLogicalDriveStringsW API and lists all available drives in the system. It searches for the target files to encrypt in all fixed, network, and removable drives.<\/p>\n

              <\/div>\n
              \"Dec2015Tesla-GetDrives\"<\/div>\n
              <\/div>\n
              <\/div>\n

              It also enumerates all network shares.
              \n\"Dec2015Tesla-network\"<\/p>\n

              Once a resource (drive or share)\u00a0is available, TeslaCrypt\u00a0searches for files to encrypt but avoids the following:<\/p>\n

                \n
              • Files from\u00a0%Windows%, %ProgramFiles%, and %AllUsers% directories.<\/li>\n
              • Files containing strings such as “recove” and “.vvv” to avoid encrypting the “HowTo_Restore” instruction files and those already encrypted.<\/li>\n<\/ul>\n
                \"Dec2015Tesla-filesearching\"<\/div>\n
                <\/div>\n

                TeslaCrypt tries to encrypt files with the following extensions:<\/p>\n

                \u00a0\"Dec2015Tesla-ext\"<\/div>\n
                <\/div>\n
                <\/div>\n

                Finally, it creates three “Howto_Restore” encrypted files in the %Desktop% directory\u00a0and pop them on\u00a0the victim’s screen:<\/p>\n

                  \n
                • Howto_Restore_FILES.TXT<\/li>\n<\/ul>\n
                  \"Dec2015Tesla-HowTXT\"<\/div>\n
                    \n
                  • Howto_Restore_FILES.HTM<\/li>\n<\/ul>\n
                    \"Dec2015Tesla-HowHTML\"<\/div>\n
                      \n
                    • Howto_Restore_FILES.BMP<\/li>\n<\/ul>\n
                      \"Dec2015Tesla-HowBMP\"<\/div>\n
                      <\/div>\n
                      <\/div>\n

                      McAfee advises users to keep their antimalware signatures up to date at all times. McAfee products detect the malicious macro, malicious JavaScript, and the TeslaCrypt payload as W97M\/Downloader.aht and JS\/Nemucod.ao, JS\/Nemucod.ap, and Ransom-Tescrypt![Partial hash], respectively,\u00a0with DAT Versions 8025 and later.<\/p>\n

                      This post was prepared with the invaluable assistance of Rakesh Sharma and Diwakar Dinkar.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

                      During the last couple of weeks, McAfee Labs has observed a huge increase in spam related to Nemucod, a malicious…<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[1814,76,338,180],"coauthors":[3973],"class_list":["post-46790","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-computer-security","tag-cybercrime","tag-endpoint-protection","tag-malware"],"acf":[],"yoast_head":"\nNew TeslaCrypt Ransomware Arrives via Spam | McAfee Blog<\/title>\n<meta name=\"description\" content=\"During the last couple of weeks, McAfee Labs has observed a huge increase in spam related to Nemucod, a malicious JavaScript that usually arrives as a\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New TeslaCrypt Ransomware Arrives via Spam | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"During the last couple of weeks, McAfee Labs has observed a huge increase in spam related to Nemucod, a malicious JavaScript that usually arrives as a\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2016-01-06T00:30:18+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-03T08:25:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Dec2015Tesla-zip-attached-email.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"517\" \/>\n\t<meta property=\"og:image:height\" content=\"499\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"New TeslaCrypt Ransomware Arrives via Spam\",\"datePublished\":\"2016-01-06T00:30:18+00:00\",\"dateModified\":\"2025-06-03T08:25:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/\"},\"wordCount\":1052,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Dec2015Tesla-zip-attached-email-300x290.jpg\",\"keywords\":[\"computer security\",\"cybercrime\",\"endpoint protection\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/\",\"name\":\"New TeslaCrypt Ransomware Arrives via Spam | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Dec2015Tesla-zip-attached-email-300x290.jpg\",\"datePublished\":\"2016-01-06T00:30:18+00:00\",\"dateModified\":\"2025-06-03T08:25:31+00:00\",\"description\":\"During the last couple of weeks, McAfee Labs has observed a huge increase in spam related to Nemucod, a malicious JavaScript that usually arrives as a\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Dec2015Tesla-zip-attached-email-300x290.jpg\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Dec2015Tesla-zip-attached-email-300x290.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"New TeslaCrypt Ransomware Arrives via Spam\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New TeslaCrypt Ransomware Arrives via Spam | McAfee Blog","description":"During the last couple of weeks, McAfee Labs has observed a huge increase in spam related to Nemucod, a malicious JavaScript that usually arrives as a","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"New TeslaCrypt Ransomware Arrives via Spam | McAfee Blog","og_description":"During the last couple of weeks, McAfee Labs has observed a huge increase in spam related to Nemucod, a malicious JavaScript that usually arrives as a","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2016-01-06T00:30:18+00:00","article_modified_time":"2025-06-03T08:25:31+00:00","og_image":[{"width":517,"height":499,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Dec2015Tesla-zip-attached-email.jpg","type":"image\/jpeg"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"New TeslaCrypt Ransomware Arrives via Spam","datePublished":"2016-01-06T00:30:18+00:00","dateModified":"2025-06-03T08:25:31+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/"},"wordCount":1052,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Dec2015Tesla-zip-attached-email-300x290.jpg","keywords":["computer security","cybercrime","endpoint protection","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/","name":"New TeslaCrypt Ransomware Arrives via Spam | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Dec2015Tesla-zip-attached-email-300x290.jpg","datePublished":"2016-01-06T00:30:18+00:00","dateModified":"2025-06-03T08:25:31+00:00","description":"During the last couple of weeks, McAfee Labs has observed a huge increase in spam related to Nemucod, a malicious JavaScript that usually arrives as a","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Dec2015Tesla-zip-attached-email-300x290.jpg","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Dec2015Tesla-zip-attached-email-300x290.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-teslacrypt-ransomware-arrives-via-spam\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"New TeslaCrypt Ransomware Arrives via Spam"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/46790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=46790"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/46790\/revisions"}],"predecessor-version":[{"id":215003,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/46790\/revisions\/215003"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=46790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=46790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=46790"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=46790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}