Ransomware Pays: FBI Updates Reveton Malware Warning

Latest malware, trying to trick users into paying a fine, claims the FBI is using audio, video, and other devices to record computer’s “illegal” activity.

Can people pay a fine online, avoid the threat of prosecution by the FBI, and unlock their locked PC all in one go?

That’s the offer made by a “Threat of Prosecution Reminder” that’s been flashing on numerous PC screens, which says that the FBI has locked the PC after finding evidence that the computer has been used to access child pornography or other illegal content. The latest version of this notice says that “all activity on this computer is being recorded using audio, video, and other devices.” But users are offered a way to pay the related fine being levied, immediately unlock their PC, and see the whole matter immediately dismissed.

The warning, however, is just a setup. “This is not a legitimate communication from the IC3, but rather is an attempt to extort money from the victim,” according to an advisory released last week by the Internet Crime Complaint Center (IC3), which is a joint effort between the FBI and the National White Collar Crime Center. “If you have received this or something similar do not follow payment instruction.”

The extortion part of the scam — now also featured on the FBI’s list of e-scams — is facilitated by a malicious application known as Reveton, which according to antivirus vendor F-Secure “fraudulently claims to be from a legitimate law enforcement authority and prevents users from accessing their infected machine, demanding that a ‘fine’ must be paid to restore normal access.” Machines are typically infected with Reveton via malicious websites — using drive-by download attacks launched by Citadel crimeware — rather than being introduced via phishing attacks or malicious email attachments.

Read more at Information Weekly