Fake Interpol Emails: The Ransomware Aimed Straight at SMBs

On July 1, 2026, Bitdefender described a ransomware campaign that specifically targets small and medium-sized businesses, with an unusual disguise: impersonating Interpol. The email warns the recipient that Interpol has observed suspicious activity involving accounts, systems, or services associated with their organization. The tone is official, alarming, and plays on the fear of a criminal investigation. That is precisely the psychological lever that pushes an SMB owner, with no dedicated security team, to click without thinking.

This campaign deserves attention because it breaks with the usual mass-ransomware pattern. No vulnerability exploitation, no access broker, no sophisticated lateral movement. Just a well-crafted email, a legitimate sharing service abused, and a user who runs the payload themselves. A short chain, cheap to operate, and tailored to organizations that cannot afford to dissect it.

The infection chain, step by step

The message carries no booby-trapped attachment, which lets it clear most filters. It points to a Proton Drive link, a perfectly legitimate encrypted storage service, where the operators have placed what they present as investigation evidence, including supposed videos. This is T1566.002 (Phishing: Spearphishing Link).

The downloaded file is an archive, often nested several levels deep, whose password is provided in the body of the email. This deliberate encryption is a sandbox bypass: the automated analyzer cannot open the archive without the password, and lets the content through. Inside sits an executable disguised as a video file, typically with a double extension such as evidence.mp4.exe, the T1036.008 technique (Masquerading: Masquerade File Type). The user thinks they are opening a video, they launch the encryptor, tracked as T1204.002 then T1486 (Data Encrypted for Impact).

The ransomware itself is rudimentary. Bitdefender notes it contains hardcoded values, including the password used for encryption and decryption, and lacks most of the features of large operations. Victims are told to contact the attackers via the Tox chat channel, and no ransom amount is announced up front. Observed sectors include food and agriculture, legal services, pharmaceuticals, media, technology, and finance.

Detect execution, not just the email

The email is hard to block reliably because it carries no malicious content, only a link to a legitimate service. The most robust detection point is at execution time, on the endpoint. Three behavioral signals combine: an executable launched from an archive extraction directory, a parent process that is a mail client or an archive manager, and a deceptive double extension.

Here is a Sigma rule that captures this pattern:

title: Executable launched from extraction folder with video double extension
id: 9a4f1c73-2e6b-48d1-b0a7-3f8c5d1e2b90
status: experimental
description: >
  Detects a process launched from a temporary extraction directory carrying a
  video-style double extension, the shape of the fake Interpol email.
references:
  - https://www.bitdefender.com/en-us/blog/hotforsecurity/fake-interpol-emails-serve-ransomware
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\Temp\'
      - '\Downloads\'
      - '\AppData\Local\Temp\'
  selection_double_ext:
    Image|contains:
      - '.mp4.exe'
      - '.avi.exe'
      - '.mov.exe'
      - '.pdf.exe'
  selection_parent:
    ParentImage|endswith:
      - '\outlook.exe'
      - '\thunderbird.exe'
      - '\7zFM.exe'
      - '\winrar.exe'
      - '\explorer.exe'
  condition: selection_double_ext and (selection_path or selection_parent)
falsepositives:
  - Very rare, legitimate executable double extensions are exceptional
level: high
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1036.008

Indicators to watch on the network side

Because the vector goes through a legitimate sharing service, network detection cannot simply block a malicious domain. Several behavioral indicators do warrant an alert though: an archive download from a Proton Drive link received in an unsolicited email, a resolution or connection to the Tox network from an office endpoint, which has no legitimate reason to speak that peer-to-peer messaging protocol, and the appearance of unusual encrypted-file extensions on shares. These behavioral indicators, correlated with the execution signal above, turn an isolated alert into a readable detection chain.

The most effective reflex is still human

No police authority, Interpol included, notifies a company of an investigation through an email containing a password-protected download link. That simple fact, passed to staff, defuses most of the campaign. Interpol communicates with national authorities, never directly with an SMB via a Proton Drive link. The double extension and the archive password provided in the message are two more signals a trained user spots immediately.

Detecting this kind of opportunistic campaign relies on correlating fresh indicators: abused sharing links, atypical contact protocols, disguised file patterns. That is what the ThreatClaw IOC feed provides, a stream of qualified, up-to-date indicators, ready to feed your SIEM or firewall to break the chain before encryption.