Malware dev lures little one exploiters into honeytrap to extort them

You not often root for a cybercriminal, however a brand new malware marketing campaign focusing on little one exploiters would not make you are feeling unhealthy for the victims.

Since 2012, risk actors have been creating quite a lot of malware and ransomware that fake to be authorities companies warning contaminated Home windows customers that they have been viewing CSAM. The malware tells victims they have to pay a “penalty” to forestall their info from being despatched to legislation enforcement.

One of many first “modern” ransomware operations, known as Anti-Baby Porn Spam Safety or ACCDFISA, used this extortion tactic mixed with initially locking Home windows desktops and encrypting recordsdata in later variations.

Quickly adopted different malware households that pretended to be legislation enforcement issuing fines for watching CSAM, corresponding to Harasom, Urausy, and the Reveton trojans.

An unlikely hero

Final week, cybersecurity researcher MalwareHunterTeam shared a pattern of a malware executable with BleepingComputer known as ‘CryptVPN’ [VirusTotal] utilizing comparable extortion ways.

Nevertheless, this time, slightly than focusing on harmless individuals, the malware developer is focusing on those that actively hunt down little one pornography.

After researching the malware, BleepingComputer discovered that risk actors created a web site to impersonate UsenetClub, a subscription service for “uncensored” entry to pictures and movies downloaded from Usenet.

Usenet is a web based dialogue platform permitting individuals to debate varied subjects in “newsgroups” to which they subscribe. Whereas Usenet is used for legitimate dialogue on a variety of points, it’s also a recognized supply of kid pornography.

A faux website created by the risk actors pretends to be UsenetClub, providing three subscription tiers to the positioning’s content material. The primary two are paid-for subscriptions starting from $69.99 monthly to $279.99 per yr.

Nevertheless, a 3rd choice claims to supply free entry after you put in a free “CryptVPN” software program and use it to entry the positioning.

Clicking on the “Download & Install” button will obtain a CryptVPN.zip file from the positioning that, when extracted, comprises a Home windows shortcut known as “CLICK-HERE-TO-INSTALL”.

This file is a shortcut to the PowerShell.exe executable with arguments to obtain the CryptVPN.exe executable, put it aside to C:WindowsTasks.exe, and execute it.

The malware executable is filled with UPX, however when unpacked, it comprises a PDB string that signifies that the writer known as the malware “PedoRansom”.

C:UsersusersourcereposPedoRansomx64ReleasePedoRansom.pdb

There’s nothing particular concerning the malware as all it does is change the goal’s wallpaper to an extortion demand and drops a ransom notice named README.TXT on the desktop, containing comparable extortion threats.

“You were searching for child exploitation and/or child sexual abuse material. You were stupid enough to get hacked,” reads the extortion demand.

“We have collected all your information, now you must pay us a ransom or your life is over.”

The extortion goes on to state that the particular person should pay $500 to the bc1q4zfspf0s2gfmuu8h5k0679sxgxjkd7aj5e6qyl Bitcoin handle inside ten days or their info will probably be leaked.

This bitcoin handle has solely acquired roughly $86 in funds at the moment.

Menace actors have been utilizing “sextortion” ways for a very long time, generally sending mass emails to giant numbers of individuals to try to scare them into paying an extortion demand.

These ways carried out very nicely initially, with spammers extorting over $50,000 weekly within the early campaigns.

Nevertheless, as time has passed by and recipients of those scams have grown wiser, sextortion campaigns don’t generate the identical income as they as soon as did.

Whereas this specific marketing campaign is a little more ingenious and can scare many searching for any such content material, we are going to probably not see many individuals paying this extortion demand.