May 25 — A new type of ransomware built to help the less-fortunate? Rather than extorting victims for personal financial gains, this group sends multi-paged ransom notes that request for victims to perform three socially driven activities in order to download the decryption key.
GoodWill ransomware
The operators of this ransomware are interested in promoting social justice. The ransomware scheme demands that people donate to the homeless, provide children with food, and offer financial assistance to those with urgent medical needs.
- Donating to the homeless: The ransomware note asks that people send new clothes to the homeless, record the action, and advertise the action on social media.
- Feed the hungry: The ransomware note also requests for people to take five less fortunate children to Dominos, Pizza Hut or KFC for a treat, take pictures and videos, and then post them on social media.
- Provide financial assistance for medical attention: The attackers urge people to provide financial assistance to anyone who needs urgent medical attention but cannot afford it. They also request for those who do supply funding to record audio of their donations, and to share that with the ransomware operators.
In summary
GoodWill ransomware operators demand that victims show proof of each activity. Victims must post records (images, audio recordings, videos) on their social media accounts.
After completion of all three activities, victims are also told to write a note on social media that describes “How you transformed yourself into a kind human being by becoming a victim of ransomware called Goodwill.”
For more on this story, please see Infosecurity Magazine. Lastly, to receive more cutting-edge cyber security news, best practices and analyses, please sign up for the CyberTalk.org newsletter.