Beware of resume emails bearing ransomware: Alert Priority High

Staysmartonline.gov.au have released information today which could affect migration agents, as people seeking to migrate to Australia will often send their CV / resume by email asking for an eligibility assessment.

You are advised to be wary of unsolicited emails purporting to attach resumes from potential job candidates. Malicious individuals are using these emails to deliver the CryptoWall 3.0 ransomware that can encrypt your files and require you to submit payment for the key to decrypt them.

The malicious emails come from a variety of addresses, including dustywarner[at]csi.com, MargaritoEverett[at]ebparks.org and SantiagoHenson[at]tom.com.

The email subject is typically ‘[first and last names of purported sender] – My resume’.

The email body generally reads:  ‘Hi, my name is [first and last names of purported sender]. I am herewith submitting my Resume under attachment for your perusal.

‘Thank you, [first name of purported sender here].

‘Attachment: [first and last names of purported sender] – My Resume.zip.’ 

A screenshot of a sample email is attached below.

 

The attachment is a .zip file which includes a single file named [first and last names of purported sender] MyResume.js. If a recipient of this email clicks on the .js file (JavaScript file), the file attempts to reach out to a list of servers and download .jpg files containing malicious executables that try to install the CryptoWall 3.0 ransomware.        

The attack appears to be targeting Australian companies and researchers indicate a new campaign may have been released on Tuesday last week.

When a user’s computer is infected with CryptoWall, the ransomware encrypts a range of file types with a strong encryption key. CryptoWall then typically displays a page to the user advising them their files have been encrypted and that they need to pay a ransom for the key to decrypt them. The message may also include a link to a website to make payment. 

It is important to note that for many victims, paying the ransom may lead to files being returned to normal. However, because you are dealing with criminals, you should be aware this is extortion and there are no guarantees you will regain access to your data. 

The criminals may not respond, they may increase their demands or they may attack you again. Unless you take preventative action, your computer will still have the same vulnerability that caused it to become infected in the first instance.

Staying safe 

Prevention is the best antidote to ransomware and other malware attacks.

Use spam filters and be cautious when opening emails, especially if there are attachments.

Make sure you are using a reputable security product.

Make sure it is up-to-date and switched on.

Make sure your operating system and applications are up-to-date.

Run a full scan of your computer—regularly.

Set and use strong and unique passwords.

Set passwords on all your hardware devices (modems and routers).                

Back up your data.

Keep a backup copy of your data in a safe place, disconnected from your computer and the internet.

Only visit reputable websites and online services.

Most up-to-date security software should identify and block ransomware. 

Recovery

The major problem with encryption based ransomware is that once your computer has become infected, the only way to recover your files is from a clean backup (if the backup has not also been encrypted) or by receiving the encryption key from the scammers.

If you have a clean back up of your data, you can use this to restore your files once you have re-established your system, free of infection.

You can also keep a copy of the encrypted files in case future events make decryption possible. Authorities may take down these ransomware gangs in the future and it might become possible to obtain the encryption key for your data.

More families from China are looking to enrol their young children in Australian schools in order to better their English and education from an earlier age, according to a report on the ABC.

The ‘go early strategy’ saw new enrolments of Chinese teenagers in Australian public and private schools hit 4,300 last year. The Australian Trade Commission said it was a rise of about 20 per cent on the previous year's new enrolments.

The total number of enrolments of Chinese school students rose to 8,386 in 2014, up from 7,447 in 2013.

Dr Minglu Chen, a lecturer at the University of Sydney's China Studies Centre, told the ABC that families were looking for better English education and a pathway to top Australian universities for their children.

"This is what we could expect from China's growing economy, which is at the moment is the second largest economy in the world, which actually also has a growing middle class," Dr Chen said.

Yesterday's post by Christopher Levingston which reported that a lecturer at a training course for Registered Migration Agents had informed course participants that the Migration Review Tribunal is "scary" and should therefore be avoided prompted me to do a survey of the most recent decisions of the MRT that are posted on the Austlii Website for the month of February 2015 (the decisions handed down in March 2015 have not been posted to the Austlii site yet).

While the February cases are of course just a "snapshot" of outcomes in the MRT, I am pleased to be able to report that the success rate in the Tribunal during that month was actually higher than the general 30% success rate that Chris had indicated was typical. My review indicated that there were 112 MRT decisions reported on Austlii for February 2015, and of that number a total of 53 appeals were successful! In percentage terms, there were positive outcomes in about 47% of the cases adjudicated during the month!

It is worthy of note that the reversals of the Department's decisions occurred in a wide range of cases - visitor visas, 457 visas, student visas, working holiday visas, prospective marriage visas and partner visas, among others.

In a recent post, I discussed a decision of the Full Court of the Federal Court of Australia which upheld the cancellation of a Refugee and Humanitarian visa that was held by a citizen of Liberia on “character grounds” - Gbojueh v Minister for Immigration and Border Protection [2015] FCAFC 43 (24 March 2015). 

In that case, the visa holder had been convicted in the District Court of South Australia of two separate offences involving unlawful sexual intercourse with a minor under the age of 14 – specifically, a 12 year old girl who was herself a refugee from Liberia. In the Gjbueh case, the Minister exercised his powers to override a decision of the AAT and to re-instate the visa cancellation on the ground that it was in the “national interest” of Australia that he do so.

The article prompted passionate commentary from readers, which included universal and strongly stated condemnation of the criminal conduct which led to the visa cancellation.

In this article, I consider another example of the Department’s visa cancellation power from a somewhat older case, dating to August 2014. This case, Taniela v Minister for Immigration and Border Protection [2014] FCAFC 104 (11 August 2014) provides a graphic illustration that even extremely long-term residence in Australia is insufficient to insulate a New Zealander who is not an Australian citizen from visa cancellation and deportation if they commit serious criminal offences in Australia.

The visa holder in this case was a citizen of New Zealand who arrived in Australia at the age of 6. In 2004 (when he was about 23 years old) he was convicted of two counts of “robbery in company” and was sentenced to 4 years in prison with a non-parole period of 2 years. He was released from custody in 2006. While still on parole, the Department issued a letter to him stating that it was considering cancelling his visa on character grounds.

While he was still on parole, the visa holder (then about 27 years old) committed a bank robbery with three other persons. During this robbery he was armed with a sawed-off shot gun. While this crime was in progress the visa holder and his co-offenders became aware that the police had been alerted to their presence in the bank. They locked themselves in an “ATM bunker room”, and, in an attempt to escape,. Fired shots into a perimeter wall of the bank that adjoined a pedestrian walkway. Two pedestrians were wounded by these shots, albeit not fatally.

The visa holder was apprehended and convicted of a range of offences associated with this second incident, including robbery while armed with a dangerous weapon and discharging a loaded firearm with intent to resist apprehension. For these offences, he was given a sentence of 10 years and three months.

Following this second conviction, the Department cancelled his visa. An appeal to the Administrative Appeals Tribunal followed.  In determining this appeal, the AAT  considered whether the visa cancellation was proper under "Ministerial Direction No. 55 – Refusal and Cancellation Under Section 501”.  Among the factors that were considered by the AAT under the Ministerial Direction were “the strength, duration and nature” of the visa holder’s ties to Australia (which included the fact that if released (from immigration detention) he intended to live in the family home with his parents and next door to one of his sisters and her 4 children. Ultimately, the AAT concluded that the consideration of protection of the Australian community outweighed the other considerations in the case, and affirmed the cancellation of the visa.

The visa holder then appealed the visa cancellation to the Federal Court of Australia, and after failing at that level, to the Full Court.

The primary grounds of his appeal was that the visa cancellation power held by the Department under section 501 was inconsistent with the provisions of another section of the Migration Act, section 201. That section provides, in essence, that a citizen of New Zealand, who has been in Australia for less than 10 years and who commits an offence for which he is sentenced to prison for a term of at least one year may be deported.  In the circumstances of this case, because the visa holder had been in Australia for more than 10 years, he could not have been lawfully deported under section 201.

Unfortunately for the visa holder, the same arguments that he sought to ventilate concerning the supposed inconsistency between sections 201 and 501 had previously been considered and rejected by the High Court in the case of Minister for Immigration and multicultural and Indigenous Affairs v Nystrom, (2006) HCA 50; 228 CLR 566.  In that case, the High Court found that the power of visa cancellation that was created by section 501 is entirely separate and apart from section 201, and may be exercised independently. Consequently, even if a citizen of New Zealand has been resident in Australia for more than 10 years, he or she is still subject to visa cancellation on character grounds under section 501.

Thus, as it was bound to do, the Full Court followed the decision of the High Court in Nystrom and dismissed the appeal against the visa cancellation.

This case shows, in very dramatic fashion, that citizens of New Zealand who have lived in Australia for very long periods of time (either with the special status of “exempt non-citizens” or as holders of “special category” visas) are nonetheless subject to loss of their rights to remain in Australia. This can happen even if the New Zealander has very strong family ties to Australia, as was the circumstance in the Taniela  case.

What is especially striking about this case is that the visa holder might have been considered to be “practically Australian” given that he had lived in Australia from very early childhood. However, his longstanding residence in Australia and his strong family ties here were not considered by the AAT sufficient to counterbalance his record of serious criminal conduct.

The lesson of this case for the many New Zealanders who are living in Australia is that they must be always mindful to “tread lightly” and refrain from the commission of serious criminal offences(surely, committing armed bank robbery, firing a shot-gun through the walls of the bank and wounding bystanders would not come within the heading of "treading lightly" and is the type of serious criminal conduct that risks visa cancellation; likewise carrying out an armed robbery while on parole and after having been given written warning that the Department is contemplating cancelling one's visa is "playing with fire"!)

The repercussions if they do not, as shown by this case, include not only suffering the sanctions of the Australian criminal justice system, but additionally, the risk of visa cancellation and deportation from Australia.

This article was prepared by Michael Arch, Concordia Pacific Migration Lawyers, MARN 1386469, Email: This email address is being protected from spambots. You need JavaScript enabled to view it. Tel: (02) 8068 8837 Web: www.concordialaw.com.au

"Migration agents say a section of the Department of Immigration and Border Protection regulating them is overpaid and overstaffed.

The agents have called for the Migration Agents Registration Authority to be taken out of the department to strengthen the organisation's independence."