A new strain of ransomware has surfaced that pretends to be working for the good of a children's charity rather than for criminal gain, in an attempt to make handing over cash more palatable for a victim.
The newly discovered CryptoMix has been found masquerading as a Robin Hood-style of ransomware, providing links to a fictitious charity and an offer to put their name with their donation.
First spotted by cyber security firm Covewave, the ransom notes go so far as to include the names, diagnosis, and even pictures of young children that the ransom payments claim to support which, according to Covewave, the information appears to have been lifted from crowdfunding websites.
"In recent cases, Coveware observed ransom notes and communications that referenced a fictitious charity but real children," the company said. "The ransom communications begin with a .txt file that provides email addresses that the victim may use to contact the ransomware distributor."
Covewave have an example of the email exchange hackers use with this scheme. In the correspondence, they claim to work for a fictitious charity and give a description of a child's diagnosis and the funding amount being raised.
Email of a hacker using CryptoMix - courtesy of Covewave
Disturbingly, the email contained an image of what Croewave said appeared to be a 3-year-old girl lifted off a crowdfunding site.
From there, the hacker will direct the victim to view payment information with instructions on a temporary page. This page includes bitcoin wallet payment instructions and more detail on the fake charity.
"We are guessing this tactic is meant to assuage the moral hazard associated with paying a ransom," Covewave explained. "It goes without saying that these cyber criminals did think this through. It is poignantly obvious that the charity is fake, and that the details of the child's case are lifted from other sites."
After paying the ransom, a victim is given more detail about the charity as well as a message suggesting their own name will be used alongside their donation.
CryptoMix has also been identified by Avast as a particularly nasty type of ransomware that can ultimately leaves your files locked even if you pay the ransom.
This strain of ransomware was first spotted in March 2016. The spread of this ransomware could be described as a medium level of prevalence and uses exploit kits as its main delivery method.
"Once CryptoMix infects a machine, it tries to communicate with its command and control server to establish a key to encrypt files. However, if the server is not available or if there is a connection issue, such as a blocked communication by a firewall, the ransomware will encrypt files with one of its fixed keys, or 'offline key'," it said.
-
Box reveals new AI capabilities at BoxWorks 2025News Extract and Automate will help businesses make better use of their data, the cloud company claims
-
Big tech CEOs are fueling the fire of AI confusionOpinion Mixed messaging on the effectiveness of AI only raises fears that the technology will steal human jobs
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
