“Ransomware” has quickly become cybercriminals' favorite weapon
Paul Laubacher

PARIS - The hunt lasted for more than a year. In February, the Spanish police announced that they had arrested 11 people suspected of belonging to one of the most sophisticated cybercrime networks in the world.

The hackers were from Russia, Ukraine and Georgia. They had created a super-virus called Reveton, specifically designed for cyber-kidnapping. This malware is capable of accessing any computer and blocking all access to the machine and its data. When the user tries to use his computer, a message pops up demanding a ransom – of 100 to 200 euros – to unlock it.

These kinds of viruses are called “ransomware” and have fast become a cybercriminal’s favorite weapon.

The perfect con

According to Symantec’s annual Norton Cybercrime Report, every second 18 adult Internet users are a victim of cybercrime – one and a half million victims every day around the world. And the phenomenon is growing.

The McAfee antivirus company recorded 120,000 new ransomware viruses in the second quarter of 2012, a fourfold increase from the previous year. This is because ransomware is much more efficient than phishing, which consists in obtaining the user’s banking information in order to empty his account.

Symantec researchers recently estimated that ransomware scams net $5 million a year. But this is only the tip of the iceberg: “Only 2.9% of all people affected by ransomware end up paying the ransom, but this number is increasing,” says Candid Wueest from Symantec. “As the amounts are relatively low, victims rarely press charges.” The hackers, who are rarely caught, can make up to $33,000 a day, according to Symantec.

Screenshot of a ransomware - Source: FBI

Pierre Siaut, a French security expert at TrendMicro who participated in the hunt for the Reveton hackers, says, “This case was particularly interesting. The Reveton malware displayed a message identical to the ones sent by the police: logo, legal references, fines.”

The Reveton virus is part of a recent spate of “police themed” ransomware, which use law enforcement imagery to send official-looking warning messages. The messages claim the user’s computer is locked because its user visited websites linked to terrorism or child porn etc., and say users must pay a fine for the computer to be unlocked.

With this elaborate scam, the victim is much more liable to pay up. Reveton is so elaborate that it is even able to identify the user’s language and country through the computer’s IP address. This information enables the virus to issue a tailored message with specific references to the country’s legislation.

According to the police, the gang behind Reveton has netted millions of euros in more than 30 – mostly European – countries. Europol, the European police agency believes that there have been at least 20,000 victims of this virus.

Hunting down the hackers

In a normal cyber-kidnapping situation, the ransom is often asked in virtual money. The user must then convert his money into virtual currency via services like Ukash or MoneyPak, and then enter a code in his blocked computer. The computer will not do anything, but the money will be automatically transferred to the pirate, who will then launder it through a casino or poker website. He will play for a few minutes and then cash out from the game and collect his euros.

“In the Reveton case, the message asked to pay with prepaid cards,” says Pierre Siaut. “The victim was asked to buy a prepaid card at a service station and enter a code to transfer the money.” This is why it was so difficult to hunt down the cybercriminals, says Siaut: “The prepaid cards are almost impossible to trace on the Internet.”

Pierre Siaut says that instead of following the money trail, he had to follow the hackers’ trail. “We discovered that they had hacked into the databases of news websites. “They retrieved the registered users’ personal data, and then sent them spam luring them into fake websites.” The Reveton Trojan, which was hidden in the code of the fake website, used flaws in web browsers to install the ransomware on the victim’s computer.

The pirates had also managed to target users that were liable to engage illegal activity on the Internet, such as visiting child porn sites.

“These arrests are the results of months of research, investigation and analyses to help the police. We had a special team on the case,” says Pierre Siaut. The terrible thing, he says, is Reveton is still active: “We couldn’t take it down completely.” Europol has, for now, detected no less than 48 active Reveton mutations.

Support Worldcrunch
We are grateful for reader support to continue our unique mission of delivering in English the best international journalism, regardless of language or geography. Click here to contribute whatever you can. Merci!

Thousands of Tunisians gathered in the capital of Tunis

Hannah Steinkopf-Frank, Bertrand Hauger and Anne-Sophie Goninet

👋 Laphi!*

Welcome to Monday, where post-Merkel Germany looks set shift to a center-left coalition, San Marino and Switzerland catch up with the rest of Europe on two key social issues, and a turtle slows things down at a Japan airport. Meanwhile, we take an international look at different ways to handle beloved, yet controversial, comic books and graphic novels characters.

[*Aymara, Bolivia]

🌎  7 THINGS TO KNOW RIGHT NOW

Social Democrats narrowly win German elections: Germany's center-left party claimed a narrow victory in the federal election, beating the CDU party of outgoing chancellor Angela Merkel by just over 1.5%, according to preliminary results. SPD leader Olaf Scholz has claimed a mandate to form a government with the Greens and Liberals, in what would be Germany's first three-way ruling coalition. Germany's capital city Berlin will also get its first female mayor.

Switzerland says yes to same-sex marriage: Nearly two-thirds of Swiss voters approved the proposal to legalize same-sex marriage in a referendum, making it one of the last countries in Western Europe to do so.

San Marino voters back legal abortion: More than 77% voted in support of legalizing abortion up to 12 weeks of pregnancy in San Marino in a historic referendum for the predominantly Catholic tiny city-state, which was one of the last places in Europe that still criminalized abortion.

COVID update: Australian authorities announced they will gradually reopen lockdowned Sydney, with a system that will give vaccinated citizens more freedom than the unvaccinated. Meanwhile, Thailand will waive its mandatory quarantine requirement in Bangkok and several other regions for vaccinated travellers in November. In Brazil, a fourth member of President Jair Bolsonaro's delegation to the United Nations has tested positive to COVID-19.

Power shortages in China spread: Tight coal supplies and toughening emissions standards have led to power shortages in northeastern China, forcing numerous factories including many supplying Apple and Tesla to halt production.

Strong earthquake hits Crete, at least one killed: An earthquake of magnitude 6 struck the Greek island of Crete, with reports that at least one person was killed and several injured after buildings collapsed.

Turtle causes delays at Tokyo airport: A wandering turtle forced the Tokyo Narita airport to close its runway for twelve minutes, delaying five planes, including an All Nippon Airways plane featuring ... a sea turtle-themed fuselage.

🗞️  FRONT PAGE

"Neck and neck," titles German daily Augsburger Allgemeine about the tight results of the federal election, which according to preliminary results, is set to be won by the center-left party SPD led by Olaf Sholz by just over 1.5%. It was the country's tightest race in years, and will likely lead to long, complicated negotiations to form a coalition government.


💬  LEXICON

Magal

On Sunday, hundreds of thousands of Muslim pilgrims from Senegal, but also from elsewhere in Africa, Europe, and the United States, converged to the great Mosque of Touba, as part of the Grand Magal. The annual pilgrimage, a Wolof word meaning celebration, marks the date French colonial authorities exiled spiritual leader and founder of the Senegalese Mouride Brotherhood Sheikh Amadou Bamba.

📰  STORY OF THE DAY

Cancel Tintin? Spotting racist imagery in comics around the world

From the anti-Semitic children's books of Nazi Germany to the many racist caricatures of Asian, African or Indigenous people in the 20th century, comics have long contained prejudiced, sexist and xenophobic stereotypes. These publications have been rightfully criticized but some are pushing back, saying that this kind of unwarranted "canceling" threatens freedom of expression. Here are examples from three countries around the world about how people are handling the debate and sketching the future of comics.

🔥📚 The Adventures of Tintin and The Adventures of Asterix both emerged in French-speaking Europe during the 20th century and quickly developed global audiences. But the comic books have also been called out for controversial depictions of certain groups, including North American Indigenous peoples. And as Radio-Canada recently reported, one group of French-speaking schools in Ontario found the texts so offensive that they decided to go ahead and burn the books. The report, not surprisingly, stirred up a pretty fiery debate on the issues of free speech and what some refer to as "cancel culture."

🤠 In a more progressive model for rethinking cartoons with long — and complicated — legacies, Lucky Luke in France is taking a different direction. Telling the story of a cowboy in the Wild West, the series is notably lacking in terms of diversity. But in 2020, well-known French cartoonists Julien Berjeaut (known as Jul) and Hervé Darmenton (known as Achdé) took on the challenge of a more inclusive Lucky Luke. With its 81st album, Un Cow-Boy Dans Le Coton (A Cowboy in High Cotton), they changed the perspective to focus on recently freed Black slaves.

🇯🇵 Outside of France and Belgium, Japan arguably has the largest market for graphic novels, or manga, which first developed in the late 19th century. And like their European counterparts, certain manga titles have been accused of using racist tropes. One example is the character Mr. Popo, a genie from the popular Dragon Ball series who has been cited for having offensive features. In the meantime, more and more mangaka (creators of manga) are expanding beyond these traditional representations, including in their depictions of women, who are over-sexualized in many mangas.


➡️ Read more on Worldcrunch.com

📣 VERBATIM

"Still now, I am terrified."

— In mid-August, Afghan news anchor Beheshta Arghand interviewed Mawlawi Abdulhaq Hemad, a high-ranking Taliban representative, for TOLOnews. A historic moment for the female presenter, just days after the Islamic fundamentalist group took over Afghanistan. Now exiled in Albania, Arghand tells the BBC in a moving testimony why she had to flee to Albania and how she, like many in her country, has lost everything.

✍️ Newsletter by Anne-Sophie Goninet, Jane Herbelin, Clémence Guimier & Bertrand Hauger


Support Worldcrunch
We are grateful for reader support to continue our unique mission of delivering in English the best international journalism, regardless of language or geography. Click here to contribute whatever you can. Merci!
THE LATEST
FOCUS
TRENDING TOPICS
MOST READ