Fake COVID-19 tracking app spreads Punisher Ransomware

by James · November 29, 2022

Remember when malicious actors were spreading nerdy RAT through fake WHO security emails about COVID-19? Well, if you think that threat actors and fraudsters have given up on covid-19 related scams, then you are wrong as Punisher ransomware is out there using fake COVID-19 tracking apps.

Table of Contents

New scam on the block

Accessing reliable sources for COVID-related updates is just as important now as it was at the height of the pandemic. That’s because researchers at Cyble Research and Intelligence Labs (CRIL) have discovered a brand new variant of the Punisher ransomware being distributed through a fake COVID-19 tracking app available on a covid-19-theme-based website (covid19 digital health advicecl).

Attack analysis

Since this COVID-19 scams involve ransomware, the malicious activities start right after the malware infiltrates the system. It quickly adds data to ransom, including victims’ unique ID, system ID, BTC address, date of infection, and JavaScript codes.

After this is done, the timer is started to ensure that the ransom amount continues to increase as time passes. the ransom appears on the desktop, boot and start menus as a shortcut to a file titled “unlock files.ink”. Punisher encrypts the following data on the targeted device:

Notifies user
Download files
Check Connection
Generate password
Generate SystemID
Make connection

Who are the targets?

The attackers are targeting individuals in Chile in this campaign and for file decryption they demand $1000 in bitcoin. Researchers believe that the attackers are targeting individuals and not companies for this scam.

Their analysis is based on its modus operandi, the use of Punisher ransomware and the malware’s use of the symmetric AES-128 algorithm to encrypt data.

How to stay protected?

You must exercise caution when accessing or downloading any COVID-19-related apps or websites. Prefer to download applications from authentic sources. In addition, it is necessary to carry out regular backups, activate automatic updates and install the best anti-virus solutions. Also, avoid clicking on attachments in e-mails from unverified or unknown sources.

If you suspect that your device may be affected by the ransomware, immediately disconnect all other devices sharing the network and external storage (if any) and continue to monitor system logs for suspicious activity.