Reveton Citadel: Ransom malware merged with bank trojan
Adding injury to insult, fraudsters have merged the phenomenon of ransom Trojans with banking malware, producing a hybrid that demands money before attempting to steal user logins.
Noticed by several security firms since the turn of the year, the web drive-by Reveton Trojan tries to coax victims into handing over payments of up to $100 with the warning that they have been found accessing violent and child porn content by the US Department of Justice.
After locking up the PC to gain the user’s attention (the sophistication of this is unclear), the malware demands payment using cash transfer services that vary according to the geography of the victim's IP address. So far the Trojan behaves like one of a growing number of ransom Trojans that have spread across the Internet in the last year, almost certainly the work of the same small family of Russian gangs, according to a recent Trend Micro analysis.
