GoodWill ransomware detected in India makes victim donate to poor, provides financial help to needy patients

Advertisement
GoodWill ransomware detected in India makes victim donate to poor, provides financial help to needy patients
It's hard to quantify the number of attacks given the lack of baseline information and uneven reporting from victims.
New Delhi: A new ransomware has been detected in India that makes victims donate new clothes to homeless, feed kids in branded pizza outlets and provide financial help to anyone who needs urgent medical attention but cannot afford it, according to digital risk monitoring firm Cloudsek. The company warned that the Goodwill ransomware could also result in temporary, and possibly permanent, loss of company data and a possible shutdown of the company's operations and accompanied revenue loss.
Advertisement

"GoodWill ransomware was identified by CloudSEK researchers in March 2022. As the threat group's name suggests, the operators are allegedly interested in promoting social justice rather than conventional financial reasons," Clousek said in a report.

Once infected, the GoodWill ransomware worm encrypts documents, photos, videos, database, and other important files and renders them inaccessible without the decryption key.

Complimentary Tech Event
Discover the future of SaaS in India
The 6-part video series will capture the vision of Indian SaaS leaders and highlight the potential for the sector in the decades to come.Watch on Demand
Our Speakers
Girish Mathrubootham
Brian E. Taptich
"The actors suggest that victims perform three socially driven activities in exchange for the decryption key- donate new clothes to the homeless, record the action, and post it on social media, take five less fortunate children to Dominos Pizza Hut or KFC for a treat, take pictures and videos, and post them on social media and provide financial assistance to anyone who needs urgent medical attention but cannot afford it, at a nearby hospital, record audio, and share it with the operators," the report said.

Once all three activities are completed, the ransomware asks victims to write a note on social media (Facebook or Instagram) on "how you transformed yourself into a kind human being by becoming a victim of a ransomware called GoodWill."

Advertisement

Upon completing all three activities, the ransomware operators verify the media files shared by the victim and their posts on social media.

The actor will then share the complete decryption kit which includes the main decryption tool, password file and a video tutorial on how to recover all important files, the report said.

"Our researchers were able to trace the email address, provided by the ransomware group, back to an India-based IT security solutions & services company, that provides end-to-end managed security services," the report said.

SEE ALSO:
Elon Musk replies to Pune techie's witty tweet, says he does not run the techie's account
Billionaire wealth rose more in 2 years than in the last 23 years combined
{{}}