The creators of ransomware blackmail their victims, threatening to publish their personal files and photos online.
A new variant of the Chimera ransomware combines scareware tactics with standard file encryption procedures, and operates under the threat of publishing victims' personal files online if the requested ransom is not paid by the deadline set for them.
Currently, this new campaign is only active in Germany and targets users in the business sector. Security researchers from Botfrei were the ones who discovered this particular strain of malware.
According to their findings, the ransomware is distributed via fraudulent emails sent to victims containing a link to a Dropbox. Users who visit this link are infected with the Chimera ransomware and are then asked to pay a ransom of 2.45 Bitcoin ($694 / €630) in order to get their files back.
Chimera differs from other ransomware because, in addition to encrypting files and until the ransom payment is complete, it displays a message warning users that if they do not pay, their information will be published online.
However, according to the researchers, releasing their data constitutes an “empty” threat.
“There is currently no evidence or information as to whether criminals have stolen [data] from the affected systems or whether personal information has already been published online,” they emphasize.
While, technically, ransomware authors could devise a way to intercept and publish the files online, this is a rather impractical scenario, as it “amplifies” the traces left by criminals online and can be used by security researchers to track them down.
Ransomware authors only want to get paid, and developing this particular scareware tactic is a smart move on their part.
