Think your small business is too small to be targeted by ransomware?
That’s precisely the assumption cybercriminals hope you’ll make.
Bitdefender Antispam researchers have uncovered a phishing campaign targeting small businesses across Europe, Asia, the Middle East, and the United States with fake investigation emails impersonating law enforcement officials.
The messages claim to contain evidence of suspicious company activity, but there’s a catch: The attached ‘evidence’ is actually ransomware.
Key takeaways
- Researchers at Bitdefender Antispam Lab have identified a malicious campaign impersonating Interpol
- The emails claim to contain evidence of suspicious company activity and pressure recipients into opening a password-protected archive.
- Recipients are directed to a Proton Drive-hosted file that ultimately delivers ransomware.
- The ransomware appears to be a custom-built payload rather than a known ransomware family.
- The operation targeted organizations across Europe, Asia, the Middle East, and the United States.
- Small businesses are particularly at risk because many lack dedicated IT and cybersecurity resources.
How the attack works
The emails arrive with an urgent tone, claiming to be from Interpol’s cybercrime investigation unit, which is conducting a compliance or security review.
Recipients are told that investigators have obtained information and video material related to their organization and are encouraged to review the evidence as soon as possible.
The message is carefully crafted to create anxiety. Nobody wants to receive an email suggesting their company may be involved in suspicious or fraudulent activity or under investigation.
To review the alleged evidence, recipients are directed to a Proton Drive link containing a password-protected archive. The password is conveniently included in the email itself.
Once opened, the archive appears to contain a video file documenting the supposed activities under investigation.
Instead, the victim is greeted with malware.
The attackers use a familiar trick: disguising an executable as a video file in the hope that recipients won’t notice the difference before opening it.
The malware isn’t sophisticated. The social engineering is.
According to researchers Viorel Vrabie and Andrei Mogage, the fake video contains a ransomware payload hidden within multiple archive layers.
Once executed, the malware seeks to encrypt files across available drives and presents victims with a ransom message:
“Your computer has been compromised, and you will not be able to recover your encrypted files without the decryption key.
Do not delete any files or change their locations. Do not scan your computer, as this may complicate the recovery process.
We are available only through Tox.”
One interesting detail is what the ransom note doesn’t say:
Unlike older ransomware attacks that immediately demanded a fixed payment amount, this note doesn’t specify a ransom at all. Instead, victims are instructed to contact the attackers through a Tox chat channel.
This approach has become increasingly common among ransomware operators. Rather than demanding the same amount from every victim, attackers often prefer to negotiate after establishing contact. The final ransom may depend on the size of the organization, the perceived value of its data, and its ability to pay.
The researchers also found that the malware itself is relatively simple. The code contains hardcoded values, including the password used during encryption and decryption, and lacks many of the features typically associated with large ransomware operations.
Bitdefender researchers observed the campaign targeting organizations across multiple industries, including food and agriculture, legal services, pharmaceuticals, media, technology, and finance.
The campaign was also geographically diverse, with targets identified across Europe, Asia, the Middle East, and the United States.
Is this attack linked to a major ransomware gang?
In fact, the malware seems much simpler than the tools typically used in major ransomware operations. Beyond the relatively basic code observed by our researchers, another notable difference is how victims are instructed to make contact.
Most modern ransomware-as-a-service (RaaS) groups direct victims to a dedicated negotiation portal hosted on the dark web, where they can exchange messages, receive payment instructions, and negotiate the ransom.
In this campaign, however, the attackers simply provide a Tox chat ID. There is no dedicated negotiation portal or victim site, which is another indication that this is likely a custom-built operation rather than the work of an established ransomware group.
This suggests the malware may have been custom-built or assembled using publicly available code and tools.
The campaign highlights an important trend: cybercriminals no longer need the resources or expertise of a large ransomware gang to launch disruptive attacks. Even relatively simple malware can become a serious threat when paired with convincing social engineering.
In this case, the fake investigation email does much of the heavy lifting. The attackers rely on fear, urgency, and authority to persuade victims to launch the malware themselves.
Why small businesses remain attractive targets
Small businesses are often viewed as easier targets than large enterprises.
Many operate without dedicated IT teams or cybersecurity staff. Security responsibilities are often shared among employees who already wear multiple hats, and limited budgets can make it difficult to invest in advanced security measures or ongoing training.
When an alarming email arrives claiming to involve investigators, compliance issues, or evidence of misconduct, there may be no formal process for verifying the claims before someone clicks.
Attackers understand this reality and design campaigns specifically to exploit it.
What should you do if you opened the file?
If you downloaded and opened a file like the one used in this campaign, don’t panic, but don’t ignore it either. Acting quickly can make a big difference.
Disconnect the affected device from the network. If ransomware or other malware is running, taking the computer offline may help prevent it from communicating with attacker-controlled servers or spreading to shared drives and other devices.
Run a full security scan. Use a trusted security solution, such as Bitdefender Ultimate Small Business Security, to perform a complete scan of the affected device. Even if nothing appears unusual, remember that some threats are designed to remain hidden until they’ve completed their job.
Notify your IT administrator or managed service provider, where possible. If you’re part of a business, don’t try to deal with the incident alone. The sooner your IT team is aware, the faster they can isolate affected systems and prevent additional damage.
Inform your team about the attack. Awareness can also make a huge difference in protecting your business, devices, data, and reputation.
Change important passwords from a clean device. If there’s any chance the malware also harvested credentials, update passwords for your business email, cloud storage, financial accounts, and collaboration platforms. Use strong, unique passwords and enable multi-factor authentication wherever it’s available.
Look for signs of suspicious activity. Watch for unexpected login alerts, password reset emails, unfamiliar transactions, or files that suddenly become inaccessible. Continue monitoring your accounts over the following days, as some attacks don’t reveal their full impact immediately.
Report the incident. Report the phishing email through your email provider’s “Report phishing” feature and notify the organization being impersonated when appropriate. If your business has been infected or you suspect ransomware was executed, consider reporting the incident to your national cybersecurity agency. Sharing information about active campaigns helps authorities warn other organizations and better understand emerging threats.
You may also want to read: What to do if you clicked a phishing link in a business email
How to protect your small business moving forward
Campaigns like this prove that ransomware attacks don’t always begin with sophisticated hacking techniques. Often, they start with a message designed to create panic.
To reduce the risk of your small business falling victim to a similar ransomware attack:
Verify all unsolicited correspondence before acting: If you receive a message claiming to come from law enforcement, regulators, or another authority, don’t rely on the contact details provided in the email. Reach out through official channels to confirm whether the communication is legitimate.
Note: One of the biggest red flags in this campaign is the delivery method itself. While the attackers impersonate Interpol, legitimate law enforcement agencies don’t send unsolicited emails containing Proton Drive links to password-protected files and ask organizations to review alleged evidence of wrongdoing. If you receive a message like this, resist the urge to investigate on your own. Instead, verify the communication through official channels before opening any attachments or downloading files.
- Treat password-protected archives with caution, especially when the password is included in the email.
- Show file extensions on Windows devices: This makes it easier to spot executables masquerading as videos or documents.
- Enable multi-factor authentication wherever possible. MFA won’t stop ransomware that’s already running, but it can prevent attackers from accessing your business accounts if they also try to steal passwords.
- Keep systems and software up to date. Regular security updates help close vulnerabilities that attackers may exploit before or after a phishing attack.
- Train employees to recognize scams: Criminals increasingly rely on fear and urgency rather than technical exploits.
- Maintain secure backups: Reliable backups remain one of the best defenses against ransomware.
- Use layered security designed for small businesses: Even well-trained employees can have an off day, and attackers count on those moments. Solutions such as Bitdefender Ultimate Small Business Security add another layer of defense by helping block phishing emails, detecting malicious downloads, identifying suspicious behavior, and stopping ransomware in its tracks.
This article is published for informational and educational purposes only. The information presented is based on technical research conducted by Bitdefender Labs and publicly available sources. Bitdefender does not make any legal determination regarding the activities described herein. The mention of any company, brand, domain, or individual does not constitute an accusation of illegal activity. Readers should exercise their own judgment and consult appropriate authorities or legal counsel if they believe they have been affected by any of the activities described. Domain names and URLs listed in this article are provided solely to help consumers and security professionals identify potentially harmful infrastructure. Bitdefender disclaims any liability for actions taken based on the information in this article.
Harness Launches Autonomous Worker Agents for Software Delivery
Posted in Commentary with tags Harness on July 1, 2026 by itnerdHarness, the AI Software Delivery Platform company, today launched Autonomous Worker Agents for software delivery: the platform for enterprises to build and safely run AI agents that handle the work between writing code and shipping it to production.
Software delivery has moved through phases. First, people did the work by hand. Then they wrote scripts for individual jobs like deployment. Most recently, they connected those jobs into automated pipelines that follow fixed instructions, which is what Harness has run for large enterprises for years. Worker Agents are the next phase. Every step in the pipeline can now run as a reasoning agent rather than a fixed script, with the context, governance, sandboxing, and audit trails that enterprises need to trust agents in production.
Dozens of Harness Managed Agents are available today, and any team can customize them or build their own. A new Harness Agent Marketplace makes it easy to find, use, and share them.
The controls that keep agents safe in production
Autonomous Worker Agents run on infrastructure that the customer controls. Code and data never leave the customer’s network, and agents are governed by the same controls enterprises already use for human deployments.
These controls make Autonomous Worker Agents safe to run in production:
Easy to build, governed by your policies
Building an Autonomous Worker Agent uses the same agent-file format that has become standard across the industry. Save it to a single file, commit it to your repository, and the agent is live, governed, and available across your organization. Teams that would rather not write the file can use Harness AI to generate the agent for them. Either way, the agent runs as a governed pipeline step with the same controls, audit trail, and policy enforcement as everything else.
Once it runs, the agent has your organization’s full context. It reasons using the Harness Software Delivery Knowledge Graph, a connected map of your services, pipelines, deployments, infrastructure, incidents, and security findings. An agent assessing a vulnerability knows which services are affected and who owns them. A deployment agent knows which services depend on the one being deployed. The result is a response built for your specific environment, not a generic fix that only looks right.
Agents also meet you where you work. Through the Harness MCP Server, a developer in Cursor, Claude Code, or another tool can assign a task to a Worker Agent and have it run in Harness, with the result returned to wherever it was triggered. Wherever an agent runs, it runs under your organization’s policies, governed the same way as every other step in your pipeline.
Harness-built agents, ready to use today
Harness has pre-built Autonomous Worker Agents that handle the repetitive, time-consuming work that slows teams down across the delivery lifecycle. Here are a few of the agents available today, with more added regularly:
The Harness Agent Marketplace
The Harness Agent Marketplace is a shared catalog where Worker Agents are published and reused across an organization and the broader Harness community. Teams can adopt an existing agent rather than build their own, and contribute the agents they build back to the catalog.
It has three tiers:
Every agent in the Marketplace can be forked. A team can clone an existing agent and adjust the prompt, tools, or triggers to fit their environment. The agent one team builds to solve a problem becomes the starting point for the next team that hits the same roadblock.
Bring your own model
Autonomous Worker Agents work with any LLM provider. Connect Anthropic, AWS Bedrock, or Google Vertex AI through existing Harness connectors, and switch models per agent, per environment, or per pipeline without rewriting the agent.
Availability
Autonomous Worker Agents and the Harness Agent Marketplace are now generally available to all Harness customers. For more information, visit https://harness.io/platform/worker-agents.
Leave a comment »