Horror films are being leveraged by the crypto-ransomware pushers in pursuit of your money. One ransomware strain, JIGSAW, uses the characters from the film “Saw” to instill fear into its victims.

Trend Micro found this malware out in the wild coming from a free cloud storage service. Although the site in question has hosted crypto-ransomware in the past, it did remove the links to it when notified. The security firm said JIGSAW can still be downloaded on another site, where it is most likely bundled inside cryptominer software.

JIGSAW’s Exponential Operations

When the malware is executed, it first presents a ransom note and an image from the “Saw” film. The ransom note, written in both Portuguese and English, tells the victim how the ransom will increase over time by an exponential amount. Additionally, the ransomware will delete growing numbers of the user’s files until payment is received.

JIGSAW deletes files and increases the ransom amount every hour. This applies increasing pressure on the victim to save the remaining files and avoid paying a larger ransom. The lowest amount the user can pay ranges from $20 to $150, according to Trend Micro.

According to the security firm, this is the first known ransomware to create a copy of user files, encrypt the copies into .fun files and then delete the originals. Variants use the .KKK, .BTC and .GWS extensions for the encrypted files, as well.

Security researchers also found an alternate version that shows adult images with the ransom note. It may use adult websites as an infection vector and includes a message threatening to expose users’ behavior unless they pay up.

Fear as a Tool for Crypto-Ransomware

The ransom note warned that if the user reboots the affected computer, 1,000 files will be deleted. Further, it threatens that no duplicate copies of these files will be made, so they would be lost forever after a restart. If the user does not pay the ransom after 72 hours, all encrypted files will be deleted.

This strain of crypto-ransomware extends the goal of all such malware: getting the victim to pay. It uses the fear factor along with the usual file attacks in an attempt to ensure that a payment is made. Defeating this sort of malware depends on user vigilance that protects against any ransomware, no matter how much it tries to instill fear.