Trojan.Ransom.AB

PC security researchers have issued warnings about Trojan.Ransom.AB, a generic malware detection typically used to denote Police Ransomware and Winlocker infections. These kinds of Trojans have been around for several years and use a well known scam to steal money from inexperienced computer users. Using a Winlocker, Trojan.Ransom.AB scares its victims by making threatening messages, which appear to come from a police agency. These messages claim that the victim visited illegal pornographic websites or used copyrighted material without permission.

Variants of Trojan.Ransom.AB Are Netting Huge Profits for Criminal Organizations

Recently, real police agencies took down a large criminal organization responsible for numerous schemes involving Trojan.Ransom.AB variants. These scams have spread to more than thirty countries around the world, always following the same pattern:

• Trojan.Ransom.AB locks the victim out of the infected computer, freezing the infected computer.
• Trojan.Ransom.AB then displays a threatening message claiming that the infected computer was involved in illegal activities.
• Finally, the Trojan.Ransom.AB Trojan demands payment of a ransom using a money transfer service.

These kinds of scams allow criminal gangs to make millions of Euros in profits. Unfortunately, the arrest of the individuals belonging to the criminal organization mentioned above will likely only be a dent in a massive scheme involving numerous variants of these attacks. Trojan.Ransom.AB variants are being distributed by numerous different criminal organizations all looking to cash in the massive potential profits involved in this scam. Since the first variants of these kinds of attacks, ESG security researchers have detected dozens of Police Ransomware families, all using some kind of variant of the Trojan.Ransom.AB scam.

While there are several ways Trojan.Ransom.AB spreads from one computer to another, it seems that one of the preferred ways to spread this particular infection is using exploit kits. These are dangerous hacking tools that are set up on an attack website in order to infect visitors' computers with Trojan.Ransom.AB by exploiting known application and operating system vulnerabilities. Computer users are directed to attack websites containing an exploit kit after visiting a compromised website that contains malicious scripts. Trojan.Ransom.AB can also spread by spam email messages and through fake video codec or torrent downloads contained in unsafe websites such as pornographic websites or web pages dedicated to peer-to-peer file sharing of popular media files.