Ransomware victims told NSA's Prism program caught them with child pornography

Share this article:

Dealers of ransomware are now attempting to frighten victims into paying up by tricking them into believing they've committed illegal online actions that were uncovered by the National Security Agency's Prism surveillance program.

According to a Sunday post on the "Malware don't need Coffee" blog, the scam functions similarly to other ransomware attacks. If users surf to a compromised site or ad hosting the attack, their screen becomes locked, and a message is displayed. In this case, the messages are customized to appear like they come from the NSA's Prism mass data collection program, whose existence was exposed in documents leaked by whistleblower Edward Snowden.

Victims of the ransomware are told that are under investigation for "illegal content downloading and distribution," specifically child pornography. To avoid prosecution and have their computers unlocked, targets are told they must pay $100 through a Green Dot MoneyPak by purchasing a prepaid card and transferring the value to the fraudsters.

A researcher known as Kafeine who studied the threat believes its purveyors also are responsible for the "Kovter" ransomware, which began spreading earlier this year.

The crooks' command-and-control server is based in Russia, Kafeine said.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Information sharing requires breaking down barriers, White House cyber guru says

Information sharing requires breaking down barriers, White House ...

The White House has advanced an agenda to promote and facilitate information sharing on security threats and vulnerabilities.

Worm variant of Android ransomware, Koler, spreads via SMS

Worm variant of Android ransomware, Koler, spreads via ...

Upon infection, the Koler variant will send an SMS message to all contacts in the device's address book.

Patch for Windows flaw can be bypassed, prompts temporary fix from Microsoft

Patch for Windows flaw can be bypassed, prompts ...

The Windows zero-day received a patch last week, but the fix can still be bypassed by crafty attackers.