{"id":13505,"date":"2016-11-22T11:34:18","date_gmt":"2016-11-22T16:34:18","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=13505"},"modified":"2019-11-15T06:51:46","modified_gmt":"2019-11-15T11:51:46","slug":"ransoc-ransomware","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/ransoc-ransomware\/13505\/","title":{"rendered":"Ransoc: a convincing threat"},"content":{"rendered":"<p>Imagine that your computer suddenly shows you a disturbing message: \u201cIt\u2019s FBI. Illegal content has been detected on your device. You\u2019ll be arrested for 20 years and fined for $200,000 unless you pay $100 in bitcoins.\u201d<\/p>\n<p>\u201cHa! \u2014 you\u2019ll say. \u2014 Not so fast, ransomware! You aren\u2019t getting a penny \u2014 instead I\u2019ll use a <a href=\"https:\/\/www.kaspersky.com\/blog\/kaspersky-windowsunlocker-2\/12275\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">special tool<\/a> to remove you from my PC.\u201d<\/p>\n<p>Lockers like this were commonly spread from  2012-2014, but now they have primarily <a href=\"https:\/\/www.kaspersky.com\/blog\/mobile-ransomware-2016\/12491\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">moved to smartphones<\/a>, where they are harder to deal with, while on PCs cryptoransomware inherited their place.<\/p>\n<p>Nonetheless, lockers did not leave computers completely \u2013 they have evolved to use the<br>\nmost efficient persuading methods. The <a href=\"https:\/\/www.proofpoint.com\/uk\/threat-insight\/post\/ransoc-desktop-locking-ransomware-ransacks-local-files-social-media-profiles\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">recently discovered<\/a> Ransoc locker serves as an interesting example of the evolutionary process.<\/p>\n<p>The main difference between Ransoc and <i>usual lockers<\/i> is its highly increased ability to persuade users. The ransomware blocks browsing and shows the victim\u2019s personal data along with photos from social networks. In addition, the malware makes demands that look rather rational. How is that possible?<\/p>\n<p>As soon as Ransoc infects the victim\u2019s PC (usually it gets there from \u201cadult\u201d sites) it checks the hard drive for something related to illegal content like child pornography and pirated music or movies. Ransoc also checks victims accounts in Skype, Facebook and Linkedin. The Trojan uses this information to make the blackmail message sound personal.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Tip?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Tip<\/a> of the week: Fighting screen lockers with <a href=\"https:\/\/twitter.com\/kaspersky?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@kaspersky<\/a> products <a href=\"https:\/\/t.co\/SAS4x4ve9o\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/SAS4x4ve9o<\/a> <a href=\"https:\/\/t.co\/11SGH4e8nR\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/11SGH4e8nR<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/738735944132636673?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">June 3, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>As the result, victims receive creepy notifications that look very persuasive: here is their personal data, and here is the list of their illegal actions. Ransoc threats to publish the users\u2019s dirty laundry publicly and possibly on the victim\u2019s social network accounts. If the Trojan finds nothing, it doesn\u2019t blackmail the victim \u2014 at all. Many can see this as a kind of justice \u2014 vigilante style.<\/p>\n<p>In addition, every 100 milliseconds Ransoc checks if users try to launch <em>regedit, msconfig<\/em> or <em>taskmgr<\/em> utilities and kills these processes so that victims are unable to remove it from the system.<\/p>\n<p>The other thing that is interesting about Ransoc is that criminals are willing to receive ransom via bank transfer. On one hand, it makes it easier to understand who is in charge of the whole fraud. On the other hand, criminals pretend to be FBI representatives and in this case bank transfers look more convincing than bitcoins. <\/p>\n<p>All in all, Ransoc is a kind of <b>locker 2.0<\/b>, an improved and updated version of malware, that was popular three years ago.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kis-trial-ransomware\">\n<p>There are two powerful methods to stop lockers.<\/p>\n<p>1. Keep calm and don\u2019t believe all those social engineering tricks. These are not from law enforcement no matter what they claim: that\u2019s just cybercriminals which made their malware a little more advanced.<\/p>\n<p>2. Use a reliable security solution on your devices. <a href=\"https:\/\/www.kaspersky.com\/internet-security?icid=gl_kdailyplacehold_acq_ona_smm__onl_b2c_kasperskydaily_wpplaceholder____kismd___\" target=\"_blank\" rel=\"noopener nofollow\">Kaspersky Internet Security<\/a> detects Ransoc and stops it before it gathers data and tries to blackmail you. If your device is infected with this Trojan, you can remove it with the help of Kaspersky Internet Security as well.<\/p>\n<p>If you want to know more about different kinds of ransomware and how to oppose them, read <a href=\"https:\/\/www.kaspersky.com\/blog\/ransomware-faq\/13387\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">this post<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ransoc ransomware gathers data from victim\u2019s social networks and hard drives, and uses it to blackmail victims.<\/p>\n","protected":false},"author":696,"featured_media":13506,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2683],"tags":[1642,1880,420,422,723],"class_list":{"0":"post-13505","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-lockers","9":"tag-ransoc","10":"tag-ransomware","11":"tag-threats","12":"tag-trojans"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/ransoc-ransomware\/13505\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/ransoc-ransomware\/5720\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/ransoc-ransomware\/10488\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/ransoc-ransomware\/8006\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/ransoc-ransomware\/8007\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/ransoc-ransomware\/9571\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/ransoc-ransomware\/9370\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/ransoc-ransomware\/13636\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/ransoc-ransomware\/2670\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/ransoc-ransomware\/6335\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/ransoc-ransomware\/6833\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/ransoc-ransomware\/5710\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/ransoc-ransomware\/9257\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/ransoc-ransomware\/13320\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/ransoc-ransomware\/13636\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/ransoc-ransomware\/13505\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/ransoc-ransomware\/13505\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/ransomware\/","name":"Ransomware"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/13505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/696"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=13505"}],"version-history":[{"count":4,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/13505\/revisions"}],"predecessor-version":[{"id":30097,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/13505\/revisions\/30097"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/13506"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=13505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=13505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=13505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}