According to information security website CloudSEK, a new ransomware group GoodWill requires victims of their ransomware to complete a series of “good deeds” in order to regain access to the affected data.
GoodWill seems to be an organization from Mumbai, India, and like other ransomware, they will force the encryption of important data in the victim’s computer, and the victim can only get back the data after obtaining the key provided by the hacker. access rights. In past cases, the vast majority of ransomware will extort a large amount of ransom from victims to unlock their files. However, GoodWill asks victims of their ransomware to do “three acts of kindness” . From what CloudSEK reports, it’s not clear how many people they’ve targeted, or whether these people actually did what they asked for.
“Our goal in adopting the word ‘GoodWill’ is to show a story of kindness. The GoodWill team does not desire money or wealth, but the kindness of people. We want everyone on this planet to remain kind, Want to teach them a valuable lesson, willing to help the poor or the needy. So all victims of our ransomware need to do good deeds to get their files back. We understand you all feel very sorry for that Excited. Take a deep breath first and see if there are people around you who need help. You say you need help? No, the only way to help yourself is to help others, I hope you understand that.” GoodWill Ransomware main screen write
In a follow-up extortion note, GoodWill detailed the three “tasks of good deeds” to the victim.
The first task is to “provide the homeless with new clothes and blankets”, while recording the process and putting it on their personal Facebook, Instagram and WhatsApp, thereby encouraging more people to help people in need.
The second task is to “take 5 poor children under the age of 13 to Domino’s, Pizza Hut or KFC” and let them order whatever they want.
“Take a selfie with the smiling kids, then turn the whole process into a beautiful video story and post it on Facebook or Instagram Stories with the photo frame and caption we provide. Add your post Save the screenshots of the text and restaurant bills, email us the valid post link, and later our team will personally verify your task and provide you with the information for the next task. That is help People less fortunate than you, this is the right thing to do as a human being,” GoodWill wrote in the ransom note.
As for the last task, it is necessary to provide financial assistance to those who are in dire need of medical assistance but cannot afford it.
“Visit the hospital closest to you and observe the crowd. You will see people who are in dire need of paying a medical bill, but cannot afford it for some reason. You have to approach them and tell them you will provide them Help, don’t worry about it now, and then provide them with the maximum amount of medical expenses support. Just like before, you have to take selfies with them smiling, record your conversations, and send them to us.” GoodWill described this. The third task.
According to GoodWill, if the victim successfully provides strong evidence that they have completed all three tasks, then they will provide the decryption tool to remove the ransomware, whether it is a key or a video tutorial. As for how many victims will actually complete these tasks, it is another unknown at the moment, but when you see someone put on the “picture frame” provided by GoodWill and start doing good things, it means that this ransomware really works. .