Although at the moment the public eye is turned to the extortion application called Wannacry, other programs also do not waste time. The creators of the widespread extortionists Locky and Bart released a new application for file encryption called Jaff. For returning access to the files they ask for a significant amount of 2 bitcoins ($ 3,700).

A new extortionist via e-mail spam is being sent out by the Necurs botnet, Malwarebytes. For the first time this botnet appeared in 2012 and is now one of the largest and long-living. According to the April report of IBM Security, Necurs includes 6 million. Computers. This botnet has a lot of crimes, because it is one of the main channels for spreading the most dangerous banking Trojans and extortion applications. It can be no doubt that thanks to him the extortionist Jaff will get into a lot of mailboxes.

The letters found so far are posing as automatic messages from printers. In the title are the words Copy, Document, Scan, File or PDF and a random set of numbers.

The file is enclosed with the file nm. Pdf, in which the Word document is embedded. Here is a malicious macro that contains instructions for running the code. If the macro is started, the download and installation of the extortioner takes place, which immediately begins to encrypt files with different extensions. After that, an extension is added to their name. Jaff.

Then the extortionist creates two files with instructions, which describe how to pay in bitcoins to return files. The payment portal is located on the Thor network and differs little from the portal used in the Bart extortionist.