A new variant of ransomware has recently been seen in the wild, which searches for illegal content on the host computer, and then utilizes the victim"s social media accounts in order to tailor its demands.
Researchers at Proofpoint Security dubbed the malware as "Ransoc" after its ability to use social media for its modus operandi. Instead of the usual behavior of ransomware, which is to encrypt files, the malware searches a victim"s hard drive for illegally downloaded content, as well as looking for the owner"s social media accounts like Facebook, LinkedIn, and Skype. The data collected will then influence the subsequently created ransom note, which will include images from the victim"s social media accounts, threatening legal action against them.
As proof of this, one variant of the penalty notice, according to Proofpoint, only appears when the malware detects that the victim has files downloaded from torrent and warez sites. The malware will then play with the victim"s fears, stating in a notice posted in a web browser that they have indeed downloaded illegally acquired content.
Unlike the majority of ransomware that demands bitcoins or money gram cards for payment, the cybercriminals behind Ransoc instead want victims to pay through their credit card. To convince those affected to just pay up, the malware creators pledge that they will return the money back, should the victims cease downloading illegally in the next 180 days. Obviously enough, this is only a trick, and the money paid will not go back to victims anytime soon.
Fortunately enough, Ransoc uses a registry autorun key, meaning that removal after booting the computer into safe mode should get rid of the malware. As per usual, as prevention for further infection in the future, it pays to be wary of the websites we visit, as well as having good security software.
Source: Proofpoint Security via ZDNet | Blue padlock image via Shutterstock