A new variant of the Paradise ransomware attacks rarely-targeted Microsoft Office Excel IQY files. The new variant uses an evasive host, IQY, to attack a network, researchers have found. The variant attempts to lure users into opening an. attachment that retrieves a malicious Excel formula from an attacker s C2 server. This formula, in turn, contains a command to run a. PowerShell command that will download and invoke an. executable. Lastline Labs James Haughom discovered the variant in December in a spam campaign.
Source: https://threatpost.com/variant-of-paradise-ransomware-targets-office-iqy-files/153559/