Chaos ransomware attacks Minecraft players

FortiGuard experts report that Chaos ransomware attacks Windows devices and spreads under the guise of an alt list for Minecraft players on gaming forums. So far, these attacks are mainly directed against users in Japan.

The decoy used by the attackers is alt list text files, which supposedly contain credentials for Minecraft accounts (including stolen ones), but in reality only Chaos malware can be downloaded this way.

Minecraft Alt List

Researchers note that Minecraft players sometimes use alt lists when they want to troll or taunt other players (without risking being banned). Accounts from the alt list are often used for suchcrimes”, and you can usually find such lists, 例如, on paste-sites. 另外, due to the popularity of such lists, they are often distributed free of charge or created through automatic account generators.

Gamers create “alt” (alternative) accounts within Minecraft for various purposes (both good and bad): they allow them to antagonize/troll other players without having their main account banned, they provide cover for an alternative in-game identity/personality, they help avoid getting their main account banned for using cheats (gaining an unfair advantage over other gamers), 等.experts FortiGuard tell.

After encrypting the victim’s files, Chaos adds four random characters or numbers as an extension to the encrypted files. For decrypting the data, the ransomware demands a ransom in the amount of 2000 yen (about $ 17.56), and the money must be provided in the form of prepaid cards. Experts warn that Chaos is configured to search infected systems for files of various types, less than 2 MB in size. If the file size exceeds 2 兆字節, then random bytes will be inserted into the files, which will make them unrecoverable, even the victim will pay the ransom to the hackers. It is unclear whether the creators of Chaos deliberately incorporated such functionality into their ransomware in an effort to permanently damage the files of victims, or it was a mistake.

It is interesting to note that the Chaos malware was originally classified as a wiper malware with the ransomware component added later.FortiGuard told.

Let me also remind you that we talked about the fact that Grief ransomware threatens to destroy victimsdata if they turn to negotiators.

黑尔加·史密斯

我一直對電腦科學感興趣, 尤其是數據安全和主題, 而家被稱為 "數據科學", 由我十幾歲開始. 在進入病毒清除團隊擔任主編之前, 我曾喺多傢公司擔任網絡安全專家, 包括亞馬遜嘅承包商之一. 另一種體驗: 我在雅頓大學同雷丁大學任教.

留言

本網站使用Akismet嚟減垃圾郵件. 瞭解如何處理評論數據.

“返回頂部”按鈕