The New Wave of FBI Ransomware: Reveton Virus Uses Fake FBI Messages to Steal Money

Ransomware threats, or what PC users have claimed as messages purported from law enforcement agencies demanding hefty fines, are an emerging issue that the FBI has taken a lead on warning PC users of. The latest warning to come out of the FBI is a Reveton Ransomware, which utilizes fake FBI messages to extort money from computer users.

For many years, the Internet Crime Complaint Center (IC3), has done a phenomenal job at monitoring and reporting complaints related to new online threats. The latest inundation of complaints happens to be of a certain ransomware, dubbed Reveton, which specifically relays a message asking PC users to pay a find for allegedly downloading and/or distributing illegal content. Such a message may actually startle a PC user and actually persuade them into paying the so-called fine, later discovering that the fine was part of a scam. Many of these scams, such as Police Central e-crime Unit (PCEU) ransomware, Ukash Virus Ransomware and FBI Ultimate Game Card Virus Ransomware, utilize virtually the same malicious techniques. The figure displayed below is an example of a system displaying the Reveton Ransomware message due to infection.

Figure 1. Example of Reveton Ransomware screen image.

Ransomware is much like other scam-laden malware as it presents a PC user with some misleading message only to trick them out of money. The recently discovered ransomware Reveton, used in conjunction with the Citadel malware platform, was first noticed by the FBI last year. Reveton was just now listed as a threat warning by IC3 in May of this year. In some earlier forms of Reveton, it was found to turn on a computer's webcam to show the victim's image on a frozen screen. With the most recent version of Reveton, it is utilized as a ransom malware threat.

The FBI's Internet Crime Complaint Center (IC3) released their 2011 annual report outlining the most popular types of online scams. Within that report, the statistics of specific types of online scams, summarized in the their pie chart below in Figure 2., shows where FBI impersonation scams fell in second place behind work-from-home scams.

Figure 2. FBI's IC3 2011 Annual Report Online Scams stats pie chart

What Does Reveton Do Now?

Reveton ransomware basically installs malware when a PC user visits a particular compromised website. Once the machine is infected, it will then replace the screen image with a fake FBI warning message stating that the user's IP address has been linked to child pornography sites or other illegal activity. From there, the user is asked to pay a fine, usually stated as "a fine of $200 to $500 minimal wages or deprivation of liberty for two to eight years". Other fake violation messages have been reported to state a fine of up to $100,000, all for allegedly distributing "Child Porno/Zoofilia and ect."

The language listed on Reveton ransomware messages may resonate with some computer users, while others will immediately know that it is a scam. The kicker of the Reveton messages is that they actually work with some PC users and the fine is sometimes paid up. Unfortunately, those who pay the ransom end up seeking expert assistance to eventually rid their system of the malware and make an attempt to recover their 'lost money'.

Reveton ransomware may actually lock a system down preventing access to certain applications or Internet access. The IC3 strongly urges PC users who actually manage to unlock their systems from this horrendous malware, to be on alert because the malware may still be present and capture personal information through a keylogger. In such a case, Reveton could lead to utter destruction by recording online banking account logins and report the data through a remote connection to a hacker.

How to Remove Reveton Ransomware Virus

Reveton ransomware, just like any other malware threat, may be removed utilizing an antimalware/antispyware application. Because the Reveton Virus itself may remain on a system for long periods of time before it is discovered, PC users should scan their system often to remain proactive and detect instances of malware threats such as Reveton.