New Ransomware Acts Like Windows Update

A new ransomware, discovered by AVG malware researcher Jakub Kroustek, disguises itself as a Windows Update.

Called Fantom, the malware displays a fake update window while the victims files are encrypted. To try to hide the activity of the file, if you check properties of the file it will say it is a Microsoft product called critical update kb01.

The fake update screen even has a counter that looks like it is making progress in updating the system. However, this is just a ruse to give the malware time to encrypt the files. You can remove the update screen by hitting Ctrl+F4 keyboard combination. This closes the screen but does not stop the ransomware.

Once the files are encrypted, the malware will display a ransom note giving the victim his ID key and contact info for paying the ransomware with email addresses of fantomd12@yandex.ru or fantom12@techemail.com.

There is no fix for the ransomware at this time.

Source: BleepingComputer