May 27, 2015 By Douglas Bonderud 2 min read

Most Internet users have visited sites online they’d rather not talk about — especially with their spouse, employer or law enforcement. But a new Android ransomware is playing “shame game” by sending fake FBI warning messages about illegal adult content to users’ mobile devices after they open an email attachment that supposedly contains an Abode Flash Player update. In fact, it’s a variant of the popular Android.Trojan.SLocker.DZ malware, and it’s part of a spam campaign now targeting English-speaking countries.

Flash Flood of Android Ransomware

According to SCMagazine, researchers from Bitdefender detected 15,000 emails sent from servers in Ukraine to users in English-speaking countries, with the largest number of messages sent to the U.S. The attached APK file seems to be a Flash update but actually infects the device with ransomware. Unlike similar malware used on PCs, this version doesn’t encrypt files but “succeeds in denying the users access to the device,” said Bogdan Botezatu of Bitdefender. By disabling the home and navigation keys, the Android ransomware restricts users to their home screen, which shows an FBI splash screen warning that they’ve broken the law by visiting adult websites and must pay a $500 fine using a valid MoneyPak voucher code. It gets worse: According to Bitterwallet, the malware also includes lewd screenshots it claims are from the user’s browser history.

Botezatu said the malware is extremely effective because it doesn’t require administrator permissions, making it easier to sneak by security apps. Even rebooting the device won’t work because the malware runs alongside any boot process, and attempting brute-force removal by entering invalid MoneyPak codes only ups the ransom to $1500. It’s no surprise that the U.S. is the hardest-hit area since Canadian and British users aren’t likely targets of the FBI just for looking at XXX content. But as noted by CSO Online, malicious actors have also created a similar version of this malware using Koler ransomware, which serves up a warning message and ransom demand from the Royal Canadian Mounted Police.

Payback Is an Option

Fortunately, there’s an alternative for users who don’t want to pay the fine or hand over their device to corporate IT for cleaning. It requires booting in Safe Mode. First, users need to press and hold the power button, then press and hold “power off.” This should offer a “reboot to safe mode” option, allowing users to open the application manager and remove the malware directly. Alternatively, it’s possible to connect the smartphone to a PC and remove the malware remotely so long as Android Debug Bridge is enabled on the mobile device.

Android ransomware is getting more sophisticated but continues to leverage the fear of shame or discovery to convince users they should pay up rather than risk embarrassment. While it’s possible to remove this malware after the fact with no harm done, it’s easier to avoid the problem altogether. G-, R- or XXX-rated content notwithstanding, opening unsolicited email attachments is always risqué.

More from

Autonomous security for cloud in AWS: Harnessing the power of AI for a secure future

3 min read - As the digital world evolves, businesses increasingly rely on cloud solutions to store data, run operations and manage applications. However, with this growth comes the challenge of ensuring that cloud environments remain secure and compliant with ever-changing regulations. This is where the idea of autonomous security for cloud (ASC) comes into play.Security and compliance aren't just technical buzzwords; they are crucial for businesses of all sizes. With data breaches and cyber threats on the rise, having systems that ensure your…

Adversarial advantage: Using nation-state threat analysis to strengthen U.S. cybersecurity

4 min read - Nation-state adversaries are changing their approach, pivoting from data destruction to prioritizing stealth and espionage. According to the Microsoft 2023 Digital Defense Report, "nation-state attackers are increasing their investments and launching more sophisticated cyberattacks to evade detection and achieve strategic priorities."These actors pose a critical threat to United States infrastructure and protected data, and compromising either resource could put citizens at risk.Thankfully, there's an upside to these malicious efforts: information. By analyzing nation-state tactics, government agencies and private enterprises are…

6 Principles of Operational Technology Cybersecurity released by joint NSA initiative

4 min read - Today’s critical infrastructure organizations rely on operational technology (OT) to help control and manage the systems and processes required to keep critical services to the public running. However, due to the highly integrated nature of OT deployments, cybersecurity has become a primary concern.On October 2, 2024, the NSA (National Security Agency) released a new CSI titled “Principles of Operational Technology Cybersecurity.” This new guide was created in collaboration with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD SCSC) to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today