Photo: VCG

A fake "cooperation contract" email containing a remote-control Trojan downloader has been blocked by cybersecurity police in Hebi, Central China's Henan Province, with recent phishing attacks targeting China found to have frequently used IP addresses from countries including the US, the Netherlands, South Korea, India and Japan, according to a post published by the Ministry of Public Security on Tuesday.

During routine cybersecurity monitoring, the cyber police department of the Hebi Public Security Bureau discovered that an IP address within its jurisdiction had been continuously targeted by overseas cyberattacks, posing risks that network equipment could be remotely controlled and data could be leaked.

The police immediately launched an analysis and investigation and quickly identified the affected company after multiple rounds of verification.

Cybersecurity officers from the bureau then visited the company to carry out on-site handling. During inquiries, the company's person in charge recalled that he had recently received an email from an unknown sender. The email claimed to be related to business cooperation and contained a file named "cooperation contract," but the file could not be opened after being downloaded.

The abnormal situation immediately raised concerns among police officers. After technical extraction and analysis, police confirmed that the attachment was not an ordinary contract document, but a disguised remote-control Trojan downloader.

Once a user clicks on the attachment, the malicious program automatically downloads and installs a remote-control Trojan in the backend, making the entire process difficult to detect.

After gaining control permissions, attackers can remotely operate the computer, steal account passwords, personal information, business data and other sensitive information, and even use the compromised device as a "springboard" to attack other systems.

In response, local cybersecurity police immediately organized a network security "checkup," guided the company in improving its cybersecurity protection measures and helped repair system loopholes.

At present, the Hebi Public Security Bureau's cybersecurity department is conducting further investigations into suspected illegal activities involving the creation and distribution of the remote-control Trojan involved in the case.