Lucy malware for Android adds file-encryption for ransomware ops

guest · Apr 28, 2020

Lucy malware for Android adds file-encryption for ransomware ops
Ransomware Goes Mobile
April 28,l 2020
https://www.bleepingcomputer.com/ne...roid-adds-file-encryption-for-ransomware-ops/

A threat actor focusing on Android systems has expanded their malware-as-a-service (MaaS) business with file-encrypting capabilities for ransomware operations.

Named Lucy Gang by researchers, the actor is a Russian-speaking team that made itself known two years ago with the Black Rose Lucy service, offering botnet and malware dropping capabilities for Android devices.
No cryptocurrency demand
The new feature allows customers of the service to encrypt files on infected devices and show a ransom note in the browser window asking for $500. The message purports to be from the FBI and accuses the victim of storing adult content on the mobile device.
The purpose of the fake FBI‌ note is to scare the victim into obeying the cybercriminals’ request.

Interestingly, the attacker does not take cryptocurrency. Instead, they demand credit card information. This is unusual as ransomware operators are typically cashing in by making victims pay the ransom in cryptocurrency.
Click to expand...

Encrypt, decrypt, and self-delete
As far as encryption goes, Lucy first tries to retrieve all the directories on the device. In case of failure, it looks for the “/storage” directory. If this also fails, the malware searches for the “/sdcard” folder.
In the next stage, it starts encrypting the data in the selected storage location and verifies the success of the operation when it completes. The procedure does not discriminate between files, Hazum told us, as long as they can be encrypted/decrypted.
Click to expand...

Check Point Research: Lucy’s Back: Ransomware Goes Mobile

guest · Apr 29, 2020

The latest in FBI impersonation: An extortion scheme involving mobile ransomware
April 28, 2020
https://www.cyberscoop.com/android-ransomware-check-point-fbi/

The FBI has done a lot to crack down on illicit online activity in recent years, from installing cyber investigators in field offices across the country to scouring the dark web for suspects. But those efforts, needless to say, do not include locking a suspect’s phone and demanding a fee to get the data back.

It’s the latest twist on a scheme that cybercriminals have been using online for years: Make people think they’re in trouble with the feds, and shake them down for cash.
Older versions of the scheme involve fake FBI warnings that arrive via email or web browsers. Using the tactic with mobile ransomware is much less common.

On the whole, though, mobile ransomware is not as profitable for criminals as ransomware that infects PCs or enterprise systems, said Allan Liska, a threat intelligence analyst at cybersecurity company Recorded Future.

“Most people just reset their phones and move on with their lives rather than paying the ransom.”
Click to expand...

At the same time, the value that users place on their mobile phones will make them a target, said Aviran Hazum, a Check Point researcher.

“As we keep using our mobile devices for more and more day to day actions, the value behind each infected device increase,” Hazum told CyberScoop in an email.
Click to expand...

Log in or Sign up

Lucy malware for Android adds file-encryption for ransomware ops

guest Guest

guest Guest

Log in or Sign up

Lucy malware for Android adds file-encryption for ransomware ops

guest Guest

guest Guest

Useful Searches