Security News > 2020 > April > Android ransomware attack spoofs the FBI with accusation of pornography

The attack accuses victims of possessing pornography, encrypts all files on the device, and then instructs them to pay a fine to unlock the data, according to Check Point Research.
After a successful infection on an Android device, Lucy encrypts files and then displays a ransom note in a browser window.
Beyond encrypting the data and locking the device, the attacker warns that the details of this offense have been sent to the FBI Cyber Crime Department's Data Center.
Masquerading as regular video player apps, these samples are able to control infected devices by exploiting the Android accessibility service, which is designed to assist people with disabilities by automating certain user interactions.
"Mobile malware is more sophisticated, more efficient. Threat actors are learning fast, drawing from their experience of past campaigns. The FBI mimic is a clear scare tactic. Sooner or later, we anticipate the mobile world will experience a major destructive ransomware attack. It's a scary but very real possibility. We urge everyone to think twice before accepting or enabling anything while browsing videos on social media."
News URL
Related news
- FBI, Europol, and NCA Take Down 8Base Ransomware Data Leak and Negotiation Sites (source)
- US indicts 8Base ransomware operators for Phobos encryption attacks (source)
- RA World Ransomware Attack in South Asia Links to Chinese Espionage Toolset (source)
- Chinese espionage tools deployed in RA World ransomware attack (source)
- Lee Enterprises newspaper disruptions caused by ransomware attack (source)
- CISA and FBI: Ghost ransomware breached orgs in 70 countries (source)
- Southern Water says Black Basta ransomware attack cost £4.5M in expenses (source)
- Qilin ransomware claims attack at Lee Enterprises, leaks stolen data (source)
- Ransomware gangs exploit Paragon Partition Manager bug in BYOVD attacks (source)
- Hackers Exploit Paragon Partition Manager Driver Vulnerability in Ransomware Attacks (source)