A ransomware operation is targeting Russian players of the multiplayer first-person shooter Enlisted, using a fake website to spread trojanized versions of the game.
Gaijin Entertainment published the legal game Enlisted in 2021, with 500,000 to one million monthly active players.
The game is free, so threat actors could easily download the installer from the publisher and modify it to distribute malicious payloads to unsuspecting users.
The ransomware that accompanies the game's installer pretends to be the third version of the infamous WannaCry, even using the ".wncry" file extension on the encrypted files.
See also: Fake zero-day PoC exploits on GitHub spread Windows and Linux malware
See also: Windows: Kernel repair is disabled by default
Recruited into ransomware
According to Cyble researchers, who analyzed the strain, this new variant of “WannaCry” is based on the open-source “Crypter” Python locker, which was created for educational purposes.
It should be noted that this is not the first time someone has tried to imitate WannaCry, likely in an attempt to intimidate victims and secure a quick ransom payment.
The installer downloaded from the fake website is “enlisted_beta-v1.0.3.115.exe”, which drops two executable files onto the user's disk if launched, namely “ENLIST~1” (the real game) and “enlisted” (the Python ransomware launcher).
The ransomware creates a mutex during initialization to avoid running multiple instances on the infected computer.
It then parses the JSON configuration file, which specifies which file types are targeted, which directories should be skipped, which ransom note to create, which wallet address will receive the ransom , and other attack parameters.
Next, Crypter ransomware scans the working directory for a “key.txt” file to be used in the encryption step and if it does not exist, it creates it.
The encryption uses the AES-256 algorithm and all locked files receive the “.wncry” file extension.
Interestingly, the ransomware does not attempt to terminate processes or stop services, which is a common practice in modern lockers.
However, it follows the common strategy of deleting shadow copies from Windows in order to prevent easy data recovery.
After the encryption process is complete, the ransomware displays the ransom note in a special GUI application, giving the victim three days to comply with the demands.
Threat actors also modify the victim's background image to ensure that their message gets through, even if the antivirus blocks the GUI-based ransom note from launching.
The attackers do not use a Tor website or provide a secure chat link for victims, but instead use a Telegram to communicate.
See also: LockBit ransomware: Gang earned $91 million through 1,700 attacks on US organizations
National bans on popular FPS titles in Russia have forced local gamers to look elsewhere for entertainment, and Enlisted is one of their alternatives.
It appears that threat actors took advantage of this opportunity and are likely to create other fake sites for similar games with Russian localization.
Information source: bleepingcomputer.com
