According to recent reports, massive volumes of JavaScript attachments are being spammed out that contain dangerous ransomware. Sonoran recommends taking the following additional precautions to protect yourself:

• Make sure your mail protection solution is blocking macro-enabled documents and .js scripts
• Ensure users are blocked from access to downloading Tor by blacklisting the following URL: https://www.torproject.org/download/download-easy.html (the Locky virus in particular relies on downloading and installing the Tor browser and some versions may use Tor to contact the command and control servers)
• Block any items falling under the category of “proxy avoidance” or “anonymizers.”
• Disable Java in client browsers (for more information, see the following links)
• And we suggest that access to the following IPs be completely blocked at the firewall:
• 5.34.183.195
• 51.254.19.227
• 185.14.29.188
• 31.184.197.119
• 91.219.29.55

You can learn more about the Locky virus here.

Please take a look at some of our technology solutions!  We would love to speak with you.

{{cta(‘ce39036c-ba0e-419d-acc1-f556223a59a2’)}}

{{cta(‘fea8ff87-73e3-4a64-928c-3e320a3f08be’)}}

{{cta(’28ea5d35-c11b-4054-b24f-9e0722431e59′)}}