This ransomware poses as a Covid-19 tracing app
CryCryptor ransomware encrypts a victim’s an entire smartphone
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Security researchers at ESET have discovered a new ransomware called CryCryptor which has been posing has an official CanadianCovid-19 tracing app.
The ransomware emerged only a few days after the Canadian government announced its intention to back the development of a nation-wide, voluntary tracing app called COVID Alert that will be rolled out for testing in Ontario as soon as next month.
CryCryptor is distributed from two websites that claim it is a Covid-19 tracing app when in reality it is just a new ransomware family. Once a user installs the fake app on their smartphone, the ransomware encrypts all of the files on their device but instead of locking it, CryCryptor leaves a “readme” file with the attacker’s email in every directory alongside the encrypted files. Once all the target files have been encrypted, a notification is displayed on the device which reads “Personal files encrypted, see readme_now.txt”.
Thankfully though, after analyzing the app,ESETresearchers discovered an “Improper Export of Android Components” bug that allowed them to create a decryption tool.
CryCryptor
By using a simple search based on the fake Covid-19 tracing app’s package name and a few strings, ESET researchers discovered that the CryCryptor ransomware is based on open source code available onGitHub.
The developers behind the open source ransomware gave it the name CryDroid before uploading it to the developer platform. They also attempted to disguise the project as research by claiming they uploaded the code to VirusTotal.
At this time, it is still unclear as to who uploaded CryDroid in the first place but the code appeared on VirusTotal the same day it was published on GitHub. In ablog post, ESET researchers explained that there is no way the project was designed for research purposes as “no responsible researcher would publicly release a tool that is easy to misuse for malicious purposes”.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
For those who have accidentally fallen victim to CryCryptor, you can download ESET’sAndroid decryption appthough the security company warns that the app will only work for this version of the ransomware.
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Anker Nebula Mars 3 review: A powerful and truly portable projector
