This 'SAP Ariba Quote' Isn't What It Seems—It's Ransomware
Aug. 15, 2025, 1:07 p.m.
Description
A sophisticated ransomware campaign has been uncovered, masquerading as a new SAP Ariba tool. The attack uses email lures, sender spoofing, and impersonation of legitimate software vendors to deliver LeeMe Ransomware. The malware employs SAP branding, a fake GUI, and a Portuguese ransom note. It targets various file types using AES-256 encryption and includes keylogging and data exfiltration capabilities. The ransomware creates autorun entries, bypasses Windows Defender, and sets up remote access. With a relatively low ransom demand, it appears to be a widespread campaign rather than targeting high-value individuals. The attack serves as a reminder of the importance of user vigilance and proper cybersecurity measures.
Tags
Date
- Created: Aug. 15, 2025, 11:38 a.m.
- Published: Aug. 15, 2025, 11:38 a.m.
- Modified: Aug. 15, 2025, 1:07 p.m.