A crypto-ransomware, dubbed TeslaCrypt, targets more than 50 game files, across at least 20 popular titles. The ransomware operates via drive-by attacks from Flash Player and Internet Explorer, using the Angler tool.
According to a study conducted by researchers at Bromium Security, TeslaCrypt targets a total of 185 file extensions and uses the encryption to lock down data. This data includes user profiles, game progress files, maps, and settings.
Researchers also found that it tries to appear as CrytpoLocker, the infamous ransomware released by the GameOver Zeus botnet, whose activities were stopped in 2014, following the intervention of electronic authorities and security companies.
However, in a blog post released last Thursday, Bromium researcher Vadim Kotov says that the similarities between the two ransomware are only 8%, which indicates that cybercriminals only tried to take advantage of CryptoLocker's popularity.
TeslaCrypt was first discovered by Fabian Wosar of Emsisoft, who noticed that cybercriminals offered two payment options to the victim, the first demanding $1,000 / €944 via PayPal, which was then transferred to another PayPal account, while the second demanded $500 / €473 in bitcoins. However, all payment processes take place over the Tor network.
Some of the titles targeted include Call of Duty, Star Craft 2, Minecraft, Half-Life 2, The Elder Scrolls (Skyrim-related files), WarCraft 3 and Assassin's Creed. Files for the online games World of Warcraft, League of Legends and World of Tanks were also targeted.
Researchers are still analyzing the ransomware, trying to understand its structure and code.
