Researchers have discovered a new ransomware variant that encrypts data of popular computer games like Call of Duty, Minecraft and World of Warcraft but also iTunes files. The ransomware is a variant of the Crypto Locker-ransomware that infects systems using a recently patched leak in Flash Player and an older leak in Internet Explorer, according security company Bromium in a report to Security.NL.
The cybercriminals use Flash advertisements that redirect users to a website that tries to infect users with vulnerable IE and Flash player versions. The banner only redirects Internet Explorer and Opera users to the malicious website.
In case the attack is successful, the ransomware encrypts 185 different file extensions, including files used by computer games. According to Bromium the latter is a novelty in ransomware. The malware searches for specific games and directories of gaming software, like Steam, publishers and development software. Striking is that the list of games the ransomware searches for, contains a lot of "classic" games likes Diablo, Fallout 3, Half-Life 2 and Warcraft 3. Also many different online games are targeted, including World of Warcraft, Day-Z, League of Legends and World of Tanks.
"Encryption of these games shows an evolution in crypto-ransomware, whereby cybercriminals target niches", according to the researchers. Bromium also states that many young adults have no important files on their computer and save pictures in the cloud. "But most of them certainly have a Steam account with several games and an iTunes account filled with music. Even to adults these attacks can be frustrating, if they lose their games and personal data."
Remarkable about the list of games that are encrypted is that although they are popular games, none of them top the lists of most played and most sold games. It's likely the ransomware developer has picked the games he likes to play himself and tested them with his own system first.
