Ransomware Cryptoware: TeslaCrypt holds PC game players hostage; $1,000 fee to decrypt games, mods, Steam
A new strain of encrypting ransomware is forcing PC gamers to pay up $500 in Bitcoin or $1,000 in PayPal My Cash cards, or permanently lose their user profile data, saved games, maps, mods, etc. The malware, TeslaCrypt, gets into computers by attacking Internet Explorer and Opera Web browsers which are used to visit a compromised WordPress-based website. TeslaCrypt can lock up 185 different kinds of files, such as data related to video games, including Steam, single and multiplayer games, game development software, image, office, movie and compressed files, as well as the default iTunes music format file-extension .m4a.
The new crypto-ransomware, which claims to be a variant of the notorious CryptoLocker ransomware, deletes all Windows restore points from the computer, making it impossible for the user to go back and regain access to the encrypted files. The user is then left with the option of either using an uninfected backup drive to gain access to the files or pay the ransom.
Similar to other file-encrypting programs, TeslaCrypt demands the ransom to be paid in bitcoin cryptocurrency and hosts a page for obtaining the decryption key on the Tor anonymity network. TeslaCrypt claims to be using strong encryption with 2048-bit RSA keys, though researchers from the Cupertino, California-based enterprise-security firm, Bromium are analyzing the new game-targeting ransomware program to verify the claim, or figure out some way that users can decrypt the files without paying the ransom.
Since the CryptoLocker file-encrypting malware was released last year, ransom viruses have become a popular tool among computer hackers as a way to extort money from victims by threatening to delete all their data. According to researchers, the creators of CryptoLocker earned about $3 million over nine months of operation before it was finally shut down in May 2014 after a multi-national law enforcement operation.
Bromium Labs has provided the full list of targeted games and gaming software affected by TeslaCrypt:
Single User Games: Call of Duty, Star Craft 2, Diablo, Fallout 3, Minecraft, Half-Life 2, Dragon Age: Origins, The Elder Scrolls and specifically Skyrim related files, Star Wars: The Knights Of The Old Republic, WarCraft 3, F.E.A.R, Saint Rows 2, Metro 2033, Assassin's Creed, S.T.A.L.K.E.R., Resident Evil 4 and Bioshock 2.
Online games: World of Warcraft, Day Z, League of Legends, World of Tanks and Metin2.
Company Specific Files: Various EA Sports games, various Valve games and various Bethesda games
Gaming Software: Steam
Game Development Software: RPG Maker, Unity3D and Unreal Engine