Perp Walk

While it is colloquially known as ransomware, the virus is called Reveton. It's designated as a drive-by—catchable by just visiting a compromised site. Those sites are often porn sites, a fact that helps give credence to the displayed message that the user was engaged in illegal activity. Specifically, child pornography is often cited.

The scam is made even more believable because the virus is specialized, detecting the computer's location and issuing a message that looks like it's from a local authority. So U.S. victims will often see the FBI logo, while Canadians see that of the Canadian Security Intelligence Service and Austrians see the mark of the Austria Police.

Ransomware attacks victims all over the world. Malware researcher Kafeine and others maintain an ever-growing gallery of screenshots of its variants on Symantec, in mapping two ransomware variants, has shown that relatively few countries are untouched. As Kafeine points out in a post, the virus quickly adapts to its surroundings, sometimes starting out with the look and language of, say, the U.K. variant and then quickly switching to the local language and the insignia of a local authority. Ransomware has recently found its way to Iran, which monitors and restricts the Internet for its citizens, undoubtedly making the message particularly frightening for victims and, thus, lucrative for the thieves.

Reveton locks the user's computer. Even those not lured into parting with their money might find themselves unwittingly doing so. Reveton works with the Citadel malware platform, which can install other malware so that even after Reveton is removed, keystroke loggers can capture usernames, passwords, and credit card information.

Security blogger Brian Krebs reported that Kafeine, who runs the blog Malware don't need Coffee, believes the Blackhole exploit kit is ultimately responsible. The software app works by taking advantage of security holes in browsers, Flash, and Java.

Symantec reports that there are around 16 ransomware gangs. The Metropolitan Police recently arrested three individuals in England: one man was charged with suspicion of conspiracy to defraud and another man and a woman were charged with suspicion of conspiracy to defraud, money laundering, and possession of items to defraud.