A new form of ransomware is changing the threat landscape. Dubbed Ransoc, the ransomware targets and extorts pedophiles and torrent users.

The malware scans files and social media as well as strings associated with child pornography in an attempt to find victims to extort, esp. child pornographers.

The malware is spread primarily by malvertising and once it infects a system, it displays a customized “Penalty Notice” if it finds illegal files on the victims system.

If the victim doesn't pay, it threatens to publish the files that it finds or take them to trial. In most instances, the victims reputation is at stake rather than just a ransom.

Interesting enough, the ransom demand will be returned it the victim is not caught again in 180 days. It also differs in its payment method. In this case, the criminals are very self-assured by asking for credit card information.

“This ransomware is unique in how it functions and the sorts of information it collects,” Proofpoint's Threat Operations Center Vice President Kevin Epstein told SC Media via emailed comments. “It's blackmail-ware rather than hostage-ware.”

With the proliferation of ransomware, more and more users are backing up their important information.

“If a victim has their files backed up, they can just restore the files instead of paying a ransom to decrypt them,” Epstein said. “But blackmail is a new twist -- the threat of exposing illegal or even questionable activities on professional or personal social networks may be a far more compelling way to convince victims to pay up.”

Source: SCMagazine