Dealers of ransomware are now attempting to frighten victims into paying up by tricking them into believing they've committed illegal online actions that were uncovered by the National Security Agency's Prism surveillance program.
According to a Sunday post on the "Malware don't need Coffee" blog, the scam functions similarly to other ransomware attacks. If users surf to a compromised site or ad hosting the attack, their screen becomes locked, and a message is displayed. In this case, the messages are customized to appear like they come from the NSA's Prism mass data collection program, whose existence was exposed in documents leaked by whistleblower Edward Snowden.
Victims of the ransomware are told that are under investigation for "illegal content downloading and distribution," specifically child pornography. To avoid prosecution and have their computers unlocked, targets are told they must pay $100 through a Green Dot MoneyPak by purchasing a prepaid card and transferring the value to the fraudsters.
A researcher known as Kafeine who studied the threat believes its purveyors also are responsible for the "Kovter" ransomware, which began spreading earlier this year.
The crooks' command-and-control server is based in Russia, Kafeine said.
