A new ransomware has detect in India that makes victims donate new clothes to homeless, feed kids in branded pizza outlets and provide financial help to anyone who needs urgent medical attention but cannot afford it, according to digital risk monitoring firm Cloudsek.
The Cloudsek warn that the Goodwill ransomware could also result in temporary, and possibly permanent, loss of company data and a possible shutdown of the company’s operations and accompanied revenue loss.
Clousek said in a report :
“GoodWill ransomware was identified by CloudSEK researchers in March 2022. As the threat group’s name suggests, the operators are allegedly interest in promoting social justice rather than conventional financial reasons,”.
When infect, the GoodWill ransomware worm encrypts documents, photos, videos, database, and other important files and renders them inaccessible without the decryption key.
Clousek Report Said :
“The actors suggest that victims perform three socially driven activities in exchange for the decryption key- donate new clothes to the homeless, record the action, and post it on social media, take five less fortunate children to Dominos Pizza Hut or KFC for a treat, take pictures and videos, and post them on social media and provide financial assistance to anyone who needs urgent medical attention but cannot afford it, at a nearby hospital, record audio, and share it with the operators,”.
When all three activities are complete, the ransomware asks victims to write a note on social media like Facebook or Instagram on “how you transformed yourself into a kind human being by becoming a victim of a ransomware called GoodWill.”
After completing all three activities, the ransomware operators verify the media files shared by the victim and their posts on social media.
The actor will then share the complete decryption kit which includes the main decryption tool, password file and a video tutorial on how to recover all important files, as per report.
As per Report :
“Our researchers were able to trace the email address, provided by the ransomware group, back to an India-base IT security solutions & services company, that provides end-to-end managed security services,”.
