Adneukine

Adneukine is a large family of ransomware Trojans, a scam that has been responsible for millions of infections in more than thirty countries all around the world. Police Ransomware Trojans in the Adneukine family carry out a typical variant of this scam. However, they integrate the use of the victim's web cam and microphone into their scam, making Adneukine Police Ransomware more threatening and scary to inexperienced computer users than typical Police Ransomware variants belonging to more common Police Ransomware families like Reveton or Urausy.

Adneukine is designed to infect the victim's computer and carry out a well known scam. Adneukine will lock down the victim's computer and then force the victim to pay a substantial amount in order to unlock the infected computer. To do this, the Police Ransomware infection invading the victim's computer will cause the infected computer to display a ransom message, an alarming message that accuses the victim of illegal activities and threatens the PC user with imprisonment and thousands of euros in fines unless Adneukine's ransom is paid. The basic Police Ransomware scam has the following characteristics:

1. Police Ransomware uses a Winlocker to block access to the infected computer.
2. Police Ransomware Trojans can detect the victim's geographical location, displaying a fake message from the police written in the victim's language and impersonating the infected computer's region's police force.
3. The Police Ransomware message will typically threaten the victim with jail time unless a fine of a few hundred euros is paid through a money transfer service such as MoneyPak and Ukash.

Specific Characteristics of Police Ransomware Trojans in the Adneukine Family of Malware

ESG security researchers have associated several high-profile Police Ransomware Trojans in the United Kingdom with the Adneukine family of malware. There is no doubt that there are numerous other variants in the Adneukine family, targeting different countries all around the world. One of the main characteristics of malware in the Adneukine family is that they will often include a large alert in the message indicating that the victim's activity is being recorded through the infected computer's microphone and camera. This is one advanced feature that many other ransomware Trojan families have still not implemented, displaying a video feed of the infected computer's web cam in order to lend authenticity to the attack. Malware in the Adneukine family also tend to use similar color schemes for their message's frame, and a side-by-side comparison of several variants reveals identical layouts and design in their ransom message.