Hacking extortionist resurfaces
2006 Trojan besets users again, demands $300 to unlock encrypted files
Computerworld - "Ransomware" last seen in 2006 has reappeared and is trying to extort $300 from users whose files the malware has encrypted, a Russian security researcher said today.
GpCode, a Trojan horse which last made a run at users last summer, has popped up again, said Aleks Gostev, senior virus analyst with Moscow-based Kaspersky Lab Inc., in a posting to the research center's blog.
Noting the long quiet time, Gostev added: "So you can imagine our feelings this weekend, when some of our non-Russian users told us their documents, photos, archive files etc. had turned into a bunch of junk data, and a file called 'read_me.txt' had appeared on their systems."
The text file contained the "ransom" note.
"Hello, your files are encrypted with RSA-4096 algorithm. You will need at least few years to decrypt these files without our software. All your private information for last 3 months were collected and sent to us. To decrypt your files you need to buy our software. The price is $300."
So-called ransomware typically follows the GpCode pattern: malware sneaks onto a PC, encrypts files, and then displays a message demanding money to unlock the data.
Gostev hinted that the blackmailer was likely Russian. "The e-mail address is one that we've seen before in LdPinch and Banker [Trojan horse] variants, programs which were clearly of Russian origin," he said.
The blackmailer's claim that the files were enciphered with RSA-4096 -- the RSA algorithm locked with a 4,096-bit key -- is bogus, said Gostev. Another oddity, he added, was that the Trojan has a limited shelf life: from July 10 to July 15.
"Why? We can only guess," said Gostev.
Kaspersky is working on a decryption scheme to recover the files; that process has been the usual salvation -- and solution -- for users attacked by ransomware. "[But] we'd just like to remind you, if you've fallen victim to any type of ransomware, you should never pay up under any circumstances.
"Contact your anti-virus provider, and make sure you back up your data on a regular basis."
Read more about Security in Computerworld's Security Topic Center.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts