Ransomware that uses a fake children's charity for phishing
CryptoMix uses information lifted from children's charities to coerce victims into ransom payments


A new strain of ransomware has surfaced that pretends to be working for the good of a children's charity rather than for criminal gain, in an attempt to make handing over cash more palatable for a victim.
The newly discovered CryptoMix has been found masquerading as a Robin Hood-style of ransomware, providing links to a fictitious charity and an offer to put their name with their donation.
First spotted by cyber security firm Covewave, the ransom notes go so far as to include the names, diagnosis, and even pictures of young children that the ransom payments claim to support which, according to Covewave, the information appears to have been lifted from crowdfunding websites.
"In recent cases, Coveware observed ransom notes and communications that referenced a fictitious charity but real children," the company said. "The ransom communications begin with a .txt file that provides email addresses that the victim may use to contact the ransomware distributor."
Covewave have an example of the email exchange hackers use with this scheme. In the correspondence, they claim to work for a fictitious charity and give a description of a child's diagnosis and the funding amount being raised.
Email of a hacker using CryptoMix - courtesy of Covewave
Disturbingly, the email contained an image of what Croewave said appeared to be a 3-year-old girl lifted off a crowdfunding site.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
From there, the hacker will direct the victim to view payment information with instructions on a temporary page. This page includes bitcoin wallet payment instructions and more detail on the fake charity.
"We are guessing this tactic is meant to assuage the moral hazard associated with paying a ransom," Covewave explained. "It goes without saying that these cyber criminals did think this through. It is poignantly obvious that the charity is fake, and that the details of the child's case are lifted from other sites."
After paying the ransom, a victim is given more detail about the charity as well as a message suggesting their own name will be used alongside their donation.
CryptoMix has also been identified by Avast as a particularly nasty type of ransomware that can ultimately leaves your files locked even if you pay the ransom.
This strain of ransomware was first spotted in March 2016. The spread of this ransomware could be described as a medium level of prevalence and uses exploit kits as its main delivery method.
"Once CryptoMix infects a machine, it tries to communicate with its command and control server to establish a key to encrypt files. However, if the server is not available or if there is a connection issue, such as a blocked communication by a firewall, the ransomware will encrypt files with one of its fixed keys, or 'offline key'," it said.
Bobby Hellard is ITPro's Reviews Editor and has worked on CloudPro and ChannelPro since 2018. In his time at ITPro, Bobby has covered stories for all the major technology companies, such as Apple, Microsoft, Amazon and Facebook, and regularly attends industry-leading events such as AWS Re:Invent and Google Cloud Next.
Bobby mainly covers hardware reviews, but you will also recognize him as the face of many of our video reviews of laptops and smartphones.
-
Acer’s laptop made from oyster shells is now available in the UK
News The Acer Aspire Vero 16 aims to combine performance and sustainability, the company said
-
UK cybersecurity workers are overworked and burning out faster than global counterparts
News Gaps in visibility, poor board communication, and a lack of cyber maturity are leading to high levels of burnout
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crime
News A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so far
News A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs