This weird ransomware can only be decrypted by going to the Roblox store
source link: https://www.techradar.com/news/this-ransomware-can-only-be-decrypted-by-going-to-the-roblox-store
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
This weird ransomware can only be decrypted by going to the Roblox store
(Image credit: Getty Images)
If you thought ransomware forcing people to do good deeds was bizarre - wait until you hear about WannaFriendMe. To get the decryptor for this newly discovered ransomware (opens in new tab) strain, victims need to buy a game pass on the Roblox Game Pass store.
Roblox is a gaming platform where users get to build and play games. Game builders can monetize their creations by requiring game passes before playing. These passes can be bought with the platform’s native currency, Robux.
In the ransom note sent to the victims, it says they need to buy a specific game pass, costing 1700 Robux, or roughly $20. After acquiring the game pass, they need to contact a specific email address with their username, and a screenshot to prove the purchase.
Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/£10.99.
Chaos? Or Ryuk?
The attackers are warning the victims not to delete the game pass as that will render the process invalid.
If you thought $20 was pocket change compared to other malware (opens in new tab) operators whose demands reach tens of thousands of dollars, do keep in mind that the targets for this campaign are mostly gamers.
Another interesting point is that the threat actors are using Chaos ransomware, which tries to pass itself off as Ryuk. In mid-2021, someone started selling a Chaos ransomware builder, allowing pretty much anyone with a few extra dollars to spare, to build their own ransomware strain.
The main difference between Chaos and Ryuk, is the fact that the former is known for overwriting large files with gibberish.
In other words, once encrypted, any files larger than 2MB in size can never be retrieved. This is a known fact for Chaos, and might put off some people that considered paying the ransom demand.
The researchers that discovered the campaign, MalwareHunterTeam, said that the Chaos ransomware builder pretends to be Ryuk by default, by using the .ryuk extension for all of the encrypted files.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Recommend
-
89
frida-ios-dump Pull a decrypted IPA from a jailbroken device Usage Install frida on device sudo pip install -r requirements.txt --upgrade...
-
33
-
37
README.md reF00D - By FAPS Team the French - @CelesteBlue123 the American - @dots_tb the 【Princess of Sleeping】 - @...
-
84
README.md IPADownload
-
5
Google Play Store's Material You makeover is going live on Android 12 By Rajesh Pandey Published 12 hours ago Complete with...
-
4
Roblox sides with Apple in App Store battle against Epic Games ...
-
27
Disclaimer All content keys were redacted, they should be 128-bit hex strings. These methods involve the use of ffmpeg and -cenc_decryption_key which is not part of stable releases as of July 2022. Use nightlies fr...
-
3
Artificial IntelligenceChatGPT proves AI is finally mainstream — and things are only going to get weirderR...
-
6
Product design is going down a weird path, but we can still save itA casual analysis of our current design industry compared to the old days and principles, and why it's important to step back and...
-
3
The Lost Letters of an Imprisoned Queen Have Been Decrypted After 400 YearsMary, Queen of Scots' letters were decoded by a team of codebreakers in a discovery described as a "a literary and historical sensation."
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK