# Fake Interpol Investigation Emails Deliver Custom Ransomware to Small Businesses

> A phishing campaign impersonates Interpol's cybercrime investigation unit, pressuring small and mid-sized businesses across the US, Europe, Asia, and the Middle East into opening a password-protected Proton Drive archive containing an executable disguised as video evidence. The payload is custom-built ransomware whose developer left the decryption key hardcoded in the binary, and victims are told to negotiate via a Tox chat ID rather than a dark-web portal.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1082
- **ID:** TL-2026-1082
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Bitdefender's Antispam Lab identified an active social-engineering campaign in which threat actors send emails posing as Interpol's cybercrime investigation unit, claiming the recipient's organization is under review for suspicious account or system activity and that investigators have obtained 'video material' as evidence. The email uses formal language and urgent subject lines to convince employees their organization faces a compliance or security review, then links to a Proton Drive-hosted, password-protected archive named archive.rar (the password is included in the email body to lower suspicion and bypass automated sandboxing/email-gateway scanning that cannot open password-protected files). Inside archive.rar is a nested, multi-layered archive structure that ultimately reveals an executable disguised as a video file. When run, the file deploys a custom-built ransomware payload that encrypts files across all available local drives and drops a ransom note reading in part: 'Your computer has been compromised, and you will not be able to recover your encrypted files without the decryption key. Do not delete any files or change their locations. Do not scan your computer, as this may complicate the recovery process. We are available only through Tox.' The note provides no fixed ransom amount, requiring victims to make direct contact via a Tox chat ID (an encrypted P2P instant-messaging protocol) rather than a dedicated dark-web negotiation site — a strong indicator this is an independent actor or small group rather than an established ransomware-as-a-service (RaaS) operation. Bitdefender researcher Viorel Vrabie noted the malware's decryption functionality and the encryption/decryption password are embedded directly in the malware's own code, meaning victims can technically recover files without paying or contacting the attacker at all. Bitdefender assessed the malware was likely built using publicly available code, templates, tutorials, or AI-assisted coding, though no obvious/conclusive signs of AI assistance were detected in the sample; researchers characterized the actor as 'a less sophisticated group or individual rather than an established ransomware group,' relying primarily on psychological manipulation (fear of law-enforcement action, threats that scanning or moving files will 'complicate the recovery process') rather than technical sophistication. No data-exfiltration activity was observed, distinguishing this from double-extortion RaaS campaigns. The lure specifically targets small and mid-sized businesses across the food/agriculture, legal services, pharmaceutical, media, technology, and finance sectors in the United States, Europe, Asia, and the Middle East — organizations judged more likely to lack dedicated IT/security teams (security responsibilities often shared among employees wearing multiple hats) and more likely to react to a law-enforcement-branded threat out of fear of regulatory or reputational consequences. No CVE or software vulnerability is exploited; the entire chain relies on social engineering, authority/brand impersonation, and archive/file-type obfuscation to induce manual execution.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1566 Phishing
- T1204 User Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1083 File and Directory Discovery
- T1102 Web Service
- T1071 Application Layer Protocol
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1490 Inhibit System Recovery

## Sources

- [Fake Interpol investigation emails target small businesses with ransomware](https://www.bitdefender.com/en-us/blog/hotforsecurity/fake-interpol-emails-serve-ransomware)
- [Attackers use Interpol lure to target small businesses](https://www.darkreading.com/cyberattacks-data-breaches/attackers-use-interpol-lure-target-small-businesses)
- [Fake Interpol Investigation Emails Push Ransomware at Small Businesses Globally](https://hackread.com/fake-interpol-investigation-emails-ransomware-small-businesses/)
- [Attackers Using Fake Interpol Warning in Ransomware Attacks on SMBs](https://securityboulevard.com/2026/07/attackers-using-fake-interpol-warning-in-ransomware-attacks-on-smbs/)
- [Criminals Pose as Interpol in Phishing Emails to Deliver Ransomware](https://www.infosecurity-magazine.com/news/cybercriminals-pose-interpol/)
- ['Interpol' emails spread custom ransomware with decryption key left inside](https://www.scworld.com/news/interpol-emails-spread-custom-ransomware-with-decryption-key-left-inside)
- [Cop this! Hackers observed posing as Interpol to deploy ransomware](https://www.cyberdaily.au/security/13843-cop-this-hackers-observed-posing-as-interpol-to-deploy-ransomware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1082