Mobile Ransomware More Than Trebled in Q1, 2017

The global nightmare of ransomware shows no sign of slowing down, with the volume of mobile ransomware rising over three-fold (3.5 times) during the first few months of the year, according to Kaspersky Lab’s Malware Report for Q1, 2017. The number of mobile ransomware files detected reached 218,625 during the quarter, compared to 61,832 in the previous quarter, with the Congur family accounting for more than 86%. Ransomware targeting all devices, systems and networks also continued to grow, with 11 new cryptor families and 55,679 new modifications making their appearance in Q1.

Congur ransomware is primarily a blocker – setting or resetting the device PIN (passcode) so the requires the attackers to have administrator rights on the device, and some variants of the malware take further advantage of these rights to install their module into the system folder from where it is almost impossible to remove.
Despite the popularity of Congur, Trojan-Ransom.AndroidOS.Fusob.h remained the most widely used mobile ransomware, accounting for nearly 45% of all users attacked by this threat during the quester. Once run, the Trojan requests administrator privileges, collects information about the device, including GPS coordinates and call history, and uploads the data to a malicious server. Based on what it receives, the server may send back a command to block the device.

In all, 55,679 new Windows ransomware modifications were detected during the quarter representing a near two-fold increase on Q4, 2016 (29,450). Most of these new modifications belonged to the Cerber family.

To reduce the risk of infection, users are advised to:

· Use robust security solutions and make sure they keep all software up to date.

· Regularly run a system scan to check for possible infection.