A new ransomware scam has taken an interesting twist – rather than simply demanding payment, the attackers want the victims to fill out a survey.
It is a new tack for a scam that traditionally relies on threats and intimidation, and perhaps a foreshadowing of what is to come, noted Malwarebytes Malware Intelligence Lead Adam Kujawa.
“The users are asked to fill out demographic information, personal information – [such as] name, address, phone number – and near the end of the survey, are required to click on “special offers” from the advertisers that usually includes something along the lines of “Pay $1 for a year free subscription to XYZ magazine” or “Try a month free trial of some music download site for only $2.50″,” he said. “The survey justifies these offers by offering to the user a [fake] $25 or $50 gift certificate to somewhere like Walmart or BestBuy.”
In order to get access to a file with a code that can unlock their computer, users have to fill out the survey.
“So the attackers get paid (in this instance anyway) every time someone fills out the surveys – advertisers pay for the demographic data, they pay to have their special offers posted online and the person hosting or redirecting users to the survey makes money off of each user that completes a survey,” he said. “In the case of the Survey Ransomware, in order for the user to unlock their system, they must complete the survey. It’s kind of a pay-per-click type deal.”
It is also the latest example of the growth of ransomware in 2012. According to security vendor McAfee, the first and second quarters saw the number of ransomware samples jump 50 percent. Meanwhile, last month Symantec detailed its discovery of a command and control server for a single ransomware family that showed the gang behind it made roughly $394,000 in a single month.
This latest attack, which targets Windows machines, could herald a future where ransomware is used in other non-traditional money-making schemes, such as pay-per-click scams where the ransomware is used to force victims various web pages, the researcher explained.
“There’s just unlimited possibilities as far as what they can use the technology for,” Kujawa said.
There is no indication where the attackers behind the malware are based, he added.
