2 min read

Repairmen suspected of installing ransomware on customers’ PCs. Arrests in South Korea

Graham CLULEY

June 17, 2021

Ad One product to protect all your devices, without slowing them down.
Free 90-day trial
Repairmen suspected of installing ransomware on customers’ PCs. Arrests in South Korea

According to a report by Catalin Cimpanu at The Record, authorities in South Korea have filed charges against employees at a computer repair store.

What are the nine charged employees of the unnamed company based in Seoul alleged to have done? Created and installed ransomware onto the computers of their customers, netting more than 360 million won (approximately US $320,000.)

The report says that South Korean police claim the extortion scam began last year, after companies contacted the repair firm hoping to receive assistance in dealing with ransomware infections that had encrypted their systems.

The repair firm reportedly initially assisted victims, helping them negotiate and pay ransoms to retrieve data garbled by the attacks. However, according to The Record, “in at least 17 incidents, the employees modified ransom notes to inflate the original ransom demands in order to obtain larger funds from the victimized companies.”

In some cases the ransoms are said to have been increased ten-fold, allowing corrupt technicians to make large profits when victims agreed that a ransom demand should be paid.

That would be bad enough, but it is further claimed that technicians at the repair store installed a remote access backdoor on customers’ computers they helped recover from attacks, and would use it to launch their own ransomware attacks.

Ultimately, according to reports, the rogue staff would plant ransomware onto the computers of any customers – even those who didn’t bring their computers in due to a ransomware problem.

If there’s one thing that I thought ransomware gangs had learnt in recent years it was not to target organisations on your doorstep.

Just look at the amount of ransomware believed to originate from certain parts of Eastern Europe, but which notably goes out of its way to avoid infecting computers if it detects a Cyrillic keyboard is being used.

The theory goes that law enforcement agencies in Russia might be turning a blind eye to ransomware gangs based in the country, just so long as they don’t cause problems for companies close to home.

For instance, according to an analyis by security experts at Cybereason, the DarkSide ransomware deliberately strives to avoid infecting computers it identifies as being based in the following countries:

  • Armenia
  • Azerbaijan
  • Belarus
  • Georgia
  • Kazakhstan
  • Kyrgyzstan
  • Moldova
  • Romania
  • Russia
  • Syria
  • Tajikstan
  • Tatarstan
  • Turkmenistan
  • Ukraine
  • Uzbekistan

If South Korean police really have successfully identified members of an active ransomware gang, it sounds like the suspects may have made the elementary mistake of targeting companies far too close to home.

In the past we’ve described how stores offering repair services have tricked customers into believing their PCs are infected with malware. It’s something else to take a PC to a repair shop for fixing, only to find that you’re dealing with a potentially bigger criminal than the ones who have caused your computer to seize up in the first place.

tags


Author



Right now

Top posts

Abode IoT Security Camera Vulnerabilities Would Let Attackers Insert Images, Bitdefender Finds

Abode IoT Security Camera Vulnerabilities Would Let Attackers Insert Images, Bitdefender Finds

December 21, 2021

2 min read
Online Shoppers Beware, Mobile Scams Are on the Rise

Online Shoppers Beware, Mobile Scams Are on the Rise

December 17, 2021

2 min read
The Holiday Guide to Tech Support: Fixing the Family Computer

The Holiday Guide to Tech Support: Fixing the Family Computer

November 24, 2021

2 min read
Bitdefender Celebrates 20 Years of Cybersecurity Leadership

Bitdefender Celebrates 20 Years of Cybersecurity Leadership

November 04, 2021

3 min read
Bitdefender Study Reveals How Consumers Like (and Dislike) Managing Passwords

Bitdefender Study Reveals How Consumers Like (and Dislike) Managing Passwords

October 26, 2021

3 min read
What are drive-by download attacks and how do you prevent them?

What are drive-by download attacks and how do you prevent them?

October 25, 2021

2 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

Millions of Routers and IOT Devices Vulnerable to Malware Code Uploaded to Github Millions of Routers and IOT Devices Vulnerable to Malware Code Uploaded to Github
Vlad CONSTANTINESCU

January 27, 2022

2 min read
Mac webcam hijack flaw wins man $100,500 from Apple Mac webcam hijack flaw wins man $100,500 from Apple
Graham CLULEY

January 27, 2022

2 min read
Do You Still Need VPN If You Use HTTPS? Do You Still Need VPN If You Use HTTPS?
Vlad CONSTANTINESCU

January 26, 2022

4 min read