Malware demands payment for alleged copyright infringement

Infected users are asked to pay £50 or their computer will remain locked

A new wave of malware freezes a computer and demands payment to unlock it, this time falsely alleging victims have infringed copyright.

The campaign, spotted by Roman Hussy, who authors the abuse.ch blog, targets users in the U.K., Switzerland, Germany, Austria, France and the Netherlands.

Hussy posted a screenshot of the warning that users in the U.K. would see. It bears the logos of the Performing Right Society (PRS), a royalties collection organization, and the Metropolitan Police.

It falsely alleges that material protected by copyright has been found on the computer and subsequently has been moved to an encrypted folder "to prevent further damage."

"To unlock your computer and to avoid other legal consequences, you are obligated to pay a release fee of £50 (US$80)," it reads.

The ransom can be paid with Paysafecard, a prepaid payment card offered throughout Europe and a few other countries such as the U.S. Hussy wrote the scam's perpetrators even included information on where victims could purchase a Paysafecard.

The type of malware, known as "ransomware," is nothing new, but the methods for manipulating users into paying change frequently. Hussy wrote in early March that a similar ransomware falsely warned of child pornography on a computer, demanding a £100 fine.

In this latest version, users can be infected with the ransomware if they visit a website that has been hacked to serve up the Blackhole exploit kit. The kit tries a handful of exploits on a user's computer, and if vulnerable software is found, can infect it with malware.

Depending on where the user is located, the appropriate local page is delivered. Hussy wrote that he suspects whomever is behind the campaign is German due to the German words in the URLs in localized versions of the scam.

As of Sunday, the ransomware was only being detected by four of 42 security products on VirusTotal, Hussy wrote. In addition to locking up a computer, the malware also contains a component called Aldi Bot, which can steal online bank account credentials and conduct distributed denial-of-service attacks, Hussy wrote.

Send news tips and comments to jeremy_kirk@idg.com

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Cate Bacon

Aruba Instant On AP11D

The strength of the Aruba Instant On AP11D is that the design and feature set support the modern, flexible, and mobile way of working.

Dr Prabigya Shiwakoti

Aruba Instant On AP11D

Aruba backs the AP11D up with a two-year warranty and 24/7 phone support.

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?