Forest Global Training Partners

Cyber Risks · Krebs on Security

Inside a ‘Reveton’ Ransomware Operation

Summary: The FBI warned of a surge in Reveton ransomware that impersonates the FBI and blocks victims' machines until they pay a fine via MoneyPak, distributed largely through BlackHole exploit kits that check browsers for outdated Flash, Java and Adobe Reader plugins. Researchers tracking one Reveton gang found its BlackHole panel received more than 187,000 potential victims in a single day and successfully infected over 11,000, while a separate scam's stats page showed 322 paying victims netting more than €28,000 on May 17, 2012 and €43,750 the next day.

What's compelling: At roughly $34,500 to $54,000 a day from a single operation, the economics favor the attacker: only 3.7 percent of infected French victims paid, yet 79 payments of $100 each still cleared 7,800 Euros from one country in one day. The ransomware is also the visible symptom, not the whole infection - Reveton steals all passwords stored on the PC and is bundled with the Citadel/ZeuS Trojan, so paying the fine leaves the deeper compromise in place.

Read the original at Krebs on Security ↗

Topics
Malware
Related