A ransomware campaign targets people who are looking for child pornography content to trap them.
Remember Robin Hood, this legendary and very British hero, called Prince of Thieves, who seized the fortune of the richest to redistribute it to the poor. The circular economy before its time, which used evil to do good.
It is perhaps this story that inspired these new kind of hackers, which you will ultimately undoubtedly like, especially since they did not invent anything about the form, but rather tried to make evolve the background. Honest cybercriminals like those who attacked Lyon Terminal on April 15, 2024.
In a targeted malware campaign, these do-gooders, but also hackers, target people who search the web for child pornography content and then lure them with fake VPN software containing ransomware. You had to think about it.
The bait: a fake UsenetClub site
First, the hackers created a fake UsenetClub site from scratch. This service, a product derived from the UseNet platform, well known for its private discussion groups, which allows, among other things, the sharing of files and their illegal downloading, provides uncensored access to all kinds of content for a subscription. If illegal downloading is prohibited, the downloading of child pornography content is just as prohibited and is severely punished by law, which provides for 5 years of imprisonment and a fine of 75,000 euros for offenders.
It is precisely on this site that hackers actively track people who are looking for child pornography content. They then lure them with the fake UsenetClub, and in particular the free subscription plan, in exchange for downloading and installing software “ CryptVPN » leading them to believe that they will be able to download child pornography content in total anonymity.
Once downloaded, unzipped and installed, it is taken who thought it was taken.
PedoRansom, the “useful” ransomware that is nevertheless not successful
Offenders will be disconcerted by the change in the color of their desktop wallpaper, as well as the message warning them that they have indeed fallen into the ransomware trap, which the hackers have dubbed “ Pedoransom “.
A terse, but concise, message tells recipients that they have been hacked and must pay a $500 ransom or risk having their illegal actions broadcast across the web. A technique that is reminiscent of a ransomware campaign for which you may have already paid the price. Since 2012, malware has impersonated government agencies and threatened victims, most of whom are completely innocent, to disclose that they have consumed illegal content unless they pay a ransom. . These ransomware are also often distributed randomly by email.
These campaigns have long been successful, but today, unfortunately, they no longer seem to frighten the victims, even though they are indeed guilty of having consumed child pornography content. In fact, “PedoRansom” has only collected $86 since the start of operations.
Source : Bleeping Computer
5