{
	"id": "5f9c6592-0c6d-455e-b7a8-3e11f8b3aae8",
	"created_at": "2026-04-06T00:21:21.387225Z",
	"updated_at": "2026-04-12T02:21:20.549046Z",
	"deleted_at": null,
	"sha1_hash": "58a3673f664ab8e29697fc29c2147efac467b077",
	"title": "Spanish hospitals targeted with coronavirus-themed phishing lures in Netwalker ransomware attacks",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 42396,
	"plain_text": "Spanish hospitals targeted with coronavirus-themed phishing lures\r\nin Netwalker ransomware attacks\r\nBy Computing News\r\nPublished: 2020-03-24 · Archived: 2026-04-05 13:17:35 UTC\r\nComputing News\r\n24 March 2020 • 2 min read\r\nGroups behind Netwalker switched phishing baits to coronavirus last week - as other ransomware groups\r\npledged to avoid medical facilities\r\nHospitals in Spain have been targeted with coronavirus-themed phishing lures by attackers looking to lock-down\r\ntheir systems with Netwalker ransomware.\r\nLocal reports indicate that medical centres have been receiving emails purporting to offer \"information on\r\nCOVID-19\", but with PDF attachments that activate the ransomware, commonly associated with computer crime\r\ngroups in Eastern Europe.\r\nInformation has been passed to Spain's National Police.\r\nSpain has been particularly hard hit by the coronavirus COVID-19, with the fourth-largest outbreak in\r\nthe world\r\nMembership benefits include:\r\nUnlimited access to real-time news, analysis and opinion\r\nReceive breaking news in our daily newsletter\r\nBe the first to hear about our events and awards programmes\r\nGain exclusive discounts to our events\r\nReceive our members-only newsletter with exclusive opinion pieces from senior IT leaders\r\nFind out about new episodes of our Ctrl Alt Lead podcast featuring interviews with leading IT\r\nprofessionals\r\nAlready Subscribed?\r\nSource: https://www.computing.co.uk/news/4012969/hospitals-coronavirus-ransomware\r\nhttps://www.computing.co.uk/news/4012969/hospitals-coronavirus-ransomware\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.computing.co.uk/news/4012969/hospitals-coronavirus-ransomware"
	],
	"report_names": [
		"hospitals-coronavirus-ransomware"
	],
	"threat_actors": [
		{
			"id": "d90307b6-14a9-4d0b-9156-89e453d6eb13",
			"created_at": "2022-10-25T16:07:23.773944Z",
			"updated_at": "2026-04-12T02:00:04.694169Z",
			"deleted_at": null,
			"main_name": "Lead",
			"aliases": [
				"Casper",
				"TG-3279"
			],
			"source_name": "ETDA:Lead",
			"tools": [
				"Agentemis",
				"BleDoor",
				"Cobalt Strike",
				"CobaltStrike",
				"RbDoor",
				"RibDoor",
				"Winnti",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434881,
	"ts_updated_at": 1775960480,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/58a3673f664ab8e29697fc29c2147efac467b077.pdf",
		"text": "https://archive.orkl.eu/58a3673f664ab8e29697fc29c2147efac467b077.txt",
		"img": "https://archive.orkl.eu/58a3673f664ab8e29697fc29c2147efac467b077.jpg"
	}
}