Tech support scammers have been targeting unsuspecting internet users for quite a while now. A combination of social engineering and deception, the malicious tactic has evolved from cold calls to fake alerts and, most recently, screen locks. Tech support scammers have now added ransomware to their attack arsenal. Jakub Kroustek, an AVG security researcher, first detected the VindowsLocker ransomware and named the threat based on the file extension .vindows it appends to all encrypted files. The VindowsLocker ransomware uses the AES encryption algorithm to lock files with the following extensions: txt, doc, docx, xls, xlsx, ppt, pptx, odt, jpg, png, csv, sql, mdb, sln, php, asp, aspx, html, xml, psd

VindowsLocker mimics tech support scam

The ransomware employs a tactic typical of most tech support scams in that victims are asked to call a phone number provided and talk to a tech support personnel. In contrast, ransomware attacks in the past asked for payments and handled decryption keys using a Dark Web portal. Malwarebytes believes the scammers operate based out of India and mimic Microsoft’s tech support personnel. VindowsLocker also uses a seemingly legit Windows support page to give the false impression that the tech support is ready to help the victims. The support page asks for the victim’s email address and banking credentials to process the payment of $349.99 to unlock a computer. However, paying the ransom money doesn’t help users recover their files according to Malwarebytes. This is because VindowsLocker developers are now unable to automatically decrypt an infected computer due to some coding errors. Malwarebytes explains that VindowsLocker ransomware coders have botched one of the API keys intended for use in short sessions. Consequently, the API key expires after a short period and the encrypted files go online, barring the VindowsLocker developers from providing the AES encryption keys to victims.

Read also:

Identify the ransomware that encrypted your data with this free tool How to remove the Locky ransomware for good Malwarebytes releases free decryptor for Telecrypt ransomware Locky ransomware spreading on Facebook cloaked as .svg file

Name * Email * Commenting as . Not you? Save information for future comments
Comment

Δ