Symantec finds Breaking Bad-themed ransomware
Better call Saul, because these hackers may have encrypted your data
A new strain of ransomware styled on TV show Breaking Bad has been uncovered by Symantec.
The malware features the logo and branding of the programme's meth lab, a fictional fried chicken shop called Los Pollos Hermanos, as well as also referencing lead character Walter White.
The email address provided for "support related enquiries" is based on a popular quote from the show, "I am the one who knocks".
The threat is targeting Australian computers and encrypts users' files until they pay the attackers in the hard-to-tracedigital currency, Bitcoin.
The hackers demand an initial payment of AU$450 (228.95), which then rises to AU$1000 (508.79) if not delivered within a specified time.
Symantec believes that targets are infected through email phishing campaign, using a ZIP archive masquerading as a file from a major courier firm.
The security team wrote in a blog post: "When executed, [this] downloads the crypto ransomware onto the victim's computer. The threat also downloads and opens a legitimate .pdf file to trick users into thinking that the initial zip archive was not a malicious file."
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
It added that attackers may be using elements from an open-source penetration testing project that uses Microsoft Powershell to remotely execute script.
The malware targets almost 40 different types of file extension, including audio, video, document and archive files.
This isn't the first time that malware authors have displayed a sense of humour. The very first virus, Cascade, caused all of the text on a user's screen to fall off', giving the appearance of a heap of characters at the bottom of the screen.
Guest editor's view
TechUK CEO Julian David says: The concept of the charming bad guy with a sense of occasion and sense of humour has a long history from Dick Turpin to the Pink Panther. So I guess we should not be surprised that cybercriminals are adopting the funny guy approach. The bottom line is that the people who do this are not entertainers they are criminals and they can destroy businesses and lives. Perhaps the most disturbing part of this is that these criminals have the time and resources to add such flourishes to their efforts to rip people off.
Adam Shepherd has been a technology journalist since 2015, covering everything from cloud storage and security, to smartphones and servers. Over the course of his career, he’s seen the spread of 5G, the growing ubiquity of wireless devices, and the start of the connected revolution. He’s also been to more trade shows and technology conferences than he cares to count.
Adam is an avid follower of the latest hardware innovations, and he is never happier than when tinkering with complex network configurations, or exploring a new Linux distro. He was also previously a co-host on the ITPro Podcast, where he was often found ranting about his love of strange gadgets, his disdain for Windows Mobile, and everything in between.
You can find Adam tweeting about enterprise technology (or more often bad jokes) @AdamShepherUK.
-
MSPs urged to patch immediately after N-able issues hotfix for N-central ‘god mode’ flawNews The authentication bypass flaw in N-central could grant threat actors ‘god mode’ access
-
Red Hat launches new open source project to drive AI governanceNews The asago open source project will allow enterprises to automate compliance processes and bolster security
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals