Ransomware operators do not usually target specific victims as a source of money, but this campaign might change that.
95% of Wildfire ransomware’s targets were located in the Netherlands, according to Cisco’s Umbrella Blog. The specificity of this attack was determined by analyzing the communications of infected nodes with specific domains, particularly:
Distribution was conducted via an email phishing campaign which notified the victim of a missed package delivery. The email contained a link to download a form to reschedule the delivery. The form downloaded is a Microsoft Word document which contained malicious code which infected the victim’s computer with the WildFire Locker encryption ransomware. When opening the file, the user is prompted to "enable editing" and "enable content." After these permissions are granted, and the macro is enabled, WildFire takes control of the machine and encrypts all the files with AES-256 CBC encryption. Once all the files are encrypted, the ransomware lets the user know by a notification page, as demonstrated by the CyberCrime & Doing Time blog:
Luckily, as Kaspersky reported in August 2016, a collaborative effort between The National High Tech Crime Unit of the Dutch Police and Kaspersky, a decryption tool was created, and can be downloaded from the following locations: