Fake Interpol “Investigation” Emails Are Dropping Ransomware on Small Businesses

The email shows up on a Monday, which is when these things always seem to land. The sender says it is Interpol’s cybercrime investigation unit. The subject line is heavy with words like compliance, review, and urgent. Inside, a short, formal paragraph explains that investigators have obtained information and video material related to your organization, and that you should review the evidence as soon as possible. There is a link to a file on Proton Drive, a well-known encrypted storage service, and the password to open it is typed right there in the message.

Nobody wants to read that their company might be tangled up in a criminal investigation. That is the entire point. You click the link, type in the password, and unzip the archive. Inside is what looks like a video file — presumably the footage the email mentioned. You double-click it. There is no video. What you actually launched was a program, and it has already started encrypting the files on your computer.

This is a real campaign that Bitdefender’s antispam researchers documented at the start of July 2026, hitting small businesses across the United States, Europe, Asia, and the Middle East. What makes it worth your attention is not the malware, which turns out to be pretty basic. It is the lure. The attackers do not break in. They talk you into opening the door, using nothing more than a badge you can’t verify and a deadline you invented for yourself.

Six tells in a fake law-enforcement email

You are not hunting for a spelling mistake. This message is clean and formal on purpose. You are looking for the shape of the request — and any single one of these is reason enough to stop and verify before anyone opens anything:

1. An agency is emailing you directly with an accusation. Interpol coordinates national police forces; it does not send businesses investigation notices, and no legitimate agency opens a case against you by emailing you a file. The channel is wrong before you even read the words.
2. You are told to open an attachment to see “evidence.” Real investigators do not hand suspects the evidence and ask them to review it. An email that wants you to download and open something to learn what you supposedly did is running a script, not a case.
3. A password-protected archive with the password in the same email. The password is not there for security. It is there to slip the file past scanners that can’t look inside an encrypted archive, and to make you feel like you are handling something official.
4. Fear plus a clock. The message manufactures dread — you might be under investigation — and then tells you to act quickly. That pairing is the manipulation, not a sign the sender is real.
5. A file that says it is a video but behaves like a program. Attackers disguise an executable as a video so you don’t notice the extension before you click. On a small screen or with file extensions hidden, a .exe or .scr can pose as an .mp4 without much effort.
6. The only way to respond is a channel you’ve never used. Whether it is a link to a cloud drive or, after the fact, a demand to chat over an app called Tox, everything funnels you toward the attacker’s turf and away from anyone who could tell you it’s fake.

How the fake Interpol email actually works

The campaign runs a short, repeatable chain, and every step is designed to keep you moving forward instead of stepping back. It opens with the email itself, dressed up as an official notice from a cybercrime unit and written to create just enough anxiety that reviewing the “evidence” feels like the responsible thing to do.

From there you are steered to a password-protected archive hosted on Proton Drive. Using a legitimate, encrypted file service is a deliberate touch. It looks more credible than a random download link, and the encryption means a lot of email filters can’t peer inside to spot the malware. The password, helpfully included in the message, is the key that gets you past the last bit of friction.

Open the archive and you find a file presented as a video documenting the activity under investigation. It is not a video. It is an executable wearing a video’s name, and running it unpacks a ransomware payload buried under several layers of archive. The malware then tries to encrypt files across the drives it can reach and drops a ransom note. In this campaign the note is unusually spare: it warns you not to delete files or scan the machine, and it tells you to make contact through Tox, a peer-to-peer chat tool. It does not name a price.

That missing number is a tactic, not an oversight. As Bitdefender analyst Alina Bizga told Dark Reading, attackers increasingly “make contact first and tailor their ransom demands to the size of the organization they’ve compromised and its perceived ability to pay.” Reach out, and they size you up before they quote you.

Figure 01 · The fake-Interpol ransomware chain ScamDrill

Campaign details: Bitdefender Antispam Lab, July 2026; Dark Reading, July 2026.

The malware is crude. The fear is doing the work.

Here is the part that should change how you think about defending a small business. When Bitdefender’s researchers pulled the ransomware apart, they found it thin. The code carried hardcoded values, including the very password used to encrypt and decrypt files, and it lacked most of the machinery a serious ransomware crew builds — no dedicated dark-web negotiation portal, no polished victim site, just a Tox handle. As Bitdefender put it, the encryption key is baked into the malware itself, which means recovering the files without paying is technically possible for this sample.

So why does a flimsy piece of malware matter at all? Because the code was never the hard part. The social engineering was. The fake investigation email does the heavy lifting; by the time the ransomware runs, the victim has already been talked into launching it. “Even relatively simple malware can become a serious threat when paired with convincing social engineering,” the researchers wrote. That is the shift worth sitting with: an attacker no longer needs the budget or skills of a major ransomware gang to wreck your week. They need a believable story and one person willing to click.

It is the same lesson we keep running into from a different door. A year of high-profile intrusions has shown that the cheapest way past a company’s defenses is often a human being, not an exploit — the same pattern behind social engineering targeting small and mid-sized businesses and behind token-theft tricks like device-code phishing on Microsoft 365. The tooling changes. The pressure tactic — fear, authority, a deadline — does not.

Why criminals keep aiming at small businesses

Small businesses tend to assume they are beneath a criminal’s notice, and that assumption is precisely what makes them worth targeting. Most run without a dedicated IT or security team. Security duties get shared among people who already have day jobs, budgets are tight, and there is often no written process for checking whether an alarming message is real before someone acts on it. When an official-looking email lands claiming an investigation or a compliance problem, there may be nobody whose job it is to say “wait.”

The numbers make the mismatch concrete. In CrowdStrike’s research, smaller organizations were hit disproportionately more often than large ones, with 29% of businesses under 25 employees reporting a ransomware attack. Sophos, in its annual threat reporting, found that ransomware accounted for roughly 70% of the incidents it investigated at small-business accounts and more than 90% at midsize ones. And the true scale is almost certainly worse than any report shows: Bitdefender has noted that 55% of organizations admit they don’t report breaches even when they know they should, which keeps successful tactics in circulation against the next business in line.

Zoom out to the national picture and ransomware is not a fringe threat. The FBI’s Internet Crime Complaint Center logged $16.6 billion in reported losses across all internet crime in 2024, and it named ransomware the most pervasive threat to critical infrastructure, with related complaints up 9% over the prior year. Regulators also keep noticing that the sectors this campaign went after — healthcare, finance, agriculture, legal services — are the ones where a few locked machines can halt operations, which is exactly why we’ve written before about ransomware hitting dental and medical practices and school districts.

The one rule that stops it

Everything about this attack is built to keep you from doing the single thing that defeats it: verifying the message through a channel the attacker doesn’t control. So make that a standing rule, said out loud to everyone on your team, before a scary email ever arrives.

Real investigators expect to be verified and will not penalize you for calling to confirm. A criminal impersonating one is counting on the opposite — that the badge and the deadline will keep you from checking. Alongside that habit, a handful of unglamorous controls blunt the damage if someone does slip:

• Keep backups you actually test, stored offline or otherwise isolated. A clean restore is the difference between a bad afternoon and a business-ending event. Ransomware only has leverage over data you can’t get back another way.
• Show file extensions on Windows. It is a two-minute settings change that makes an executable posing as a video far easier to spot before anyone double-clicks.
• Turn on multi-factor authentication everywhere it’s offered. It won’t stop ransomware already running, but it keeps a stolen password from opening your email, cloud storage, and banking.
• Treat password-protected archives from outside as suspect — especially when the password is right there in the email. That combination is far more common in attacks than in legitimate business.
• Give people realistic practice. The pause-and-verify reflex has to exist before the real message lands. That is the whole idea behind a scam simulation: rehearse the moment so it feels familiar instead of frightening.

What to do in the first hour if you opened the file

If someone downloaded and ran the attachment, move quickly but don’t panic. The first hour shapes how bad this gets.

1. Disconnect the device from the network. Pull the Wi-Fi and unplug the network cable. Taking the machine offline can stop the malware from reaching shared drives, cloud folders, and other computers, and cut its line back to the attackers.
2. Don’t delete, move, or “clean” anything yet. Leave the encrypted files and the ransom note where they are. A professional may be able to attempt recovery, and preserved evidence helps if you report it.
3. Get IT or a security professional involved now. If you have a managed service provider, call them. This is not the moment to troubleshoot alone; the sooner someone experienced isolates affected systems, the less spreads.
4. Change important passwords from a different, clean device. If credentials may have been exposed, reset business email, cloud storage, and financial logins from a machine you trust, and turn on multi-factor authentication where it isn’t already.
5. Tell your team and watch for follow-on activity. Warn everyone who might get the same email, and keep an eye out for unexpected logins, password-reset messages, or files that suddenly won’t open over the next several days.
6. Report it. Flag the email through your provider’s “report phishing” feature, and if ransomware ran, report the incident to the FBI at ic3.gov and review the government’s guidance at StopRansomware.gov. Reporting feeds the warnings that reach the next business before they click.
7. Work the full sequence. Our business scam incident-response guide covers the rest — internal notifications, insurance, and closing the hole the attacker used.

The line to send your team today

Most businesses meet an attack like this for the first time with the scary email already open and a cursor hovering over the attachment. The whole scheme falls apart on contact with one standing rule — so send this to everyone who touches a company inbox, today: “If a message claims to be the police, a court, or any agency and wants us to open a file, click a link, or reply fast, we don’t. We confirm it first through a number or website we looked up ourselves. Every time, no exceptions, no matter how official it looks.”

It takes ten seconds to send. It holds up against a badge nobody can verify and a deadline the sender invented — which, stripped of everything else, is all this attack ever was.