New Ransomware: Scam Two Friends to Unlock Your PC

A new form of ransomware offers victims the chance to escape the release fee by fooling two friends into paying up instead. A security expert likened it to a malware version of a pyramid scheme.

Traditionally ransomware involves malware getting onto a computer and then encrypting all files, with an on-screen message demanding the victim pay a fee to regain access. It's unknown what proportion of people pay up, but some big organizations such as hospitals and police forces are known to have paid the fee in the past, rather than lose sensitive data or access to control systems.

The new variant is dubbed Popcorn Time. It has no connection whatsoever to software of the same name that allows people to use the Bit Torrent file sharing system to easily view Hollywood movies without having any technical knowledge (or any desire to question the file's copyright status).

Bounty Encourages Shady Behavior

As with other ransomware, Popcorn Time has a release fee. In this case, it is one unit of the virtual currency Bitcoin, equivalent to around $778 at the time of writing. That's just a little over the average ransomware demand, a figure that has risen steeply this year. (Source: channelweb.co.uk))

The twist is that there's an alternative to paying up. The Popcorn Time instructions claim users can instead get a custom link that carries a reference code and, when clicked, will attempt to install the software.

Tactic Preys On Good Relationships

The idea is to pass on the link to other people such as friends, family or colleagues in the hope that they'll be more likely to click on it than a message from an unknown contact. According to the instructions, if two other people get infected by the malware through the custom links and go on to pay the fee, the original victim will get their files back free of charge. (Source: theguardian.com)

There's no evidence yet of how many people have tried to take up this offer or if the scammers really do give out the reward for passing on the link. It's worth remembering of course that as well as being ethically horrific, spreading malware to try to gain the reward may well break local or national laws.

What's Your Opinion?

Setting aside the ethics, is this a clever tactic? Would you be tempted to spread the malware to avoid the cost? Are people who do so as bad as the original scammers?