Ransomware Attackers Pose As Police

In a new twist to ransomware attacks, the bad guys are pushing pop-up warnings posing as federal law enforcement messages that claim to have discovered illicit and illegal material on victims' computers--and the malware locks down their machines and deletes data unless they pay a fine.

Ransomware is nothing new, but researchers at Microsoft say this latest batch includes different versions for each country it targets--English, Spanish, German, and Dutch--and poses as the German Federal Police, GEMA (Germany's performance rights organization), the Swiss Federal Department of Justice and Police, the U.K. Metropolitan Police, the Spanish Police, and the Dutch Police.

Even more chilling is the message with an official-looking police banner used to intimidate the victims, which says authorities have found evidence of child pornography and emailing with terrorists: "Attention! Illegal activity was detected. The operating system was locked for infringement against the laws of Switzerland. Your IP address is . From this IP address, sites containing pornography, child pornography, bestiality, and violence against children were browsed. Your computer also has video files with pornographic content, elements of violence, and child pornography. Emails with terrorist background were also spammed. This serves to lock the computer to stop your illegal activities."

The scam is spreading via malicious email messages purportedly from federal law enforcement as well as via compromised Web pages. The Trojan then locks down the victim's machine and either encrypts or deletes data stored on the hard drive. "It then goes on to ask for a payment of 150 CHF within 24 hours over Paysafecard, or the computer's hard disk contents will supposedly be erased. To seem more legit, Trojan:Win32/Ransom.FS queries a legitimate public IP address geolocation service at tools.ip2location.com/ib2 to determine the country and the ISP from which the infected computer is connecting to the Internet," according to Microsoft.

Read the rest of this article on Dark Reading.

IT's spending as much as ever on disaster recovery, despite advances in virtualization and cloud techniques. It's time to break free. Download our Disaster Recovery Disaster supplement now. (Free registration required.)