Bitcoin Ransomware Virus Paralyzes Italian Councils

Coindesk.com reported on 22nd October, 2014 stating that computer files of Municipal council offices across Italy have been encrypted by a ransomware virus which is demanding payment in Bitcoin.

Corriere della Sera, one of the country's top newspapers, reported that dozens of local office employees are not able to pay bills, issue certificates or access server documents unless they give the digital ransom.

Presently the attacker's fee is 400 Euros worth of bitcoin and this amount is believed to double after three days.

The virus was launched from a location in St Petersburg, Russia and it spreads quickly through the system network of the council through phishing emails. Many are still at risk but some machines have been updated with antivirus software to block it successfully.

Once the malware enters into a victim's machine, it sends an ordinary looking .PDF file bearing an elongated series of characters to all links in their email address book.

On being examined closely, the file is actually found to be a malicious .exe program.

When the contact opens the program, it encrypts all photos, .PDF files and documents of Microsoft office on their server and machine making them useless.

When the block is enabled, a phony anti-virus prompts users to purchase decoding software along with step-by-step instructions necessary to complete the process and transiction. The scammers even included contact details of customer support for those who are not known to Bitcoins use.

Bitcoinvox.com published news on 23rd October, 2014 quoting Maria Grazia Mazzolari, a town clerk in Bussoleno, Turin (Italy), as saying "Even after paying the ransom, the hackers had the impudence to invite me to call them in case of any problems."

The stunt seems to be lucrative till now. Di.Fo.B, an Italian consultancy dealing with cybercrime, stated that the bitcoin addresses filed by attackers have received around $100000 from all victims during last 6 days.

Di.Fo.B also expects that this figure will go up because many targeted public offices are still not aware of the spread of this virus.

The consultancy added that this specific virus is a variant of the renowned CryptoLocker which is dubbed 'TorrentLocker'.

» SPAMfighter News - 10/31/2014