A malicious software program has targeted more than 1,300 victims and counting in Vietnam, asking them to pay ransom to avoid losing files and data, a local Internet security firm has warned.

The CTB Locker ransomware is compromising computers across the globe and spreading widely in the Southeast Asian country, Bkav said Saturday on its website.

Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in order for the restriction to be removed.

“The encrypted data cannot be recovered as the keys for decryption are only stored on hackers’ servers,” Bkav said.

The Hanoi-based firm said it has found more than 1,300 computers in Vietnam to be infected with the ransomware, and “the number of victims is increasing.”

Nguyen Minh Duc, a local Internet security expert, told Tuoi Tre (Youth) newspaper he has received many calls for help from several organizations, including banks, which had fallen victim to the CTB Locker virus.

The ransomware is spread in a sophisticated way as it is disguised as a document file attached in emails, Duc said.

Once downloaded and opened, the file still displays as a real Word document, but two malicious files are at the same time secretly installed on the victim’s computer.

“One of the malicious files will encrypt all photos and World and Excel documents, while the other acts as a communication channel between the victim and hackers,” he added.

Bkav also described another way the ransomware is spread, in which the malware is zipped and attached along spam emails.

“Once unzipped, the malware will compromise the computer and encrypts all document files,” the company said. “At the same time, the ransom-asking message will show up on the screen.”

The message tells the victims that their personal files are encrypted with the “strongest encryption” by CTB-Locker.

Hackers said the private decryption key is stored on “a secret Internet server” and nobody can decrypt the files until victims “pay and obtain the private key,” according to a screenshot of the message obtained by Bkav.

Victims are given 96 hours to submit the payment. Refusal to pay means their files will be “permanently encrypted and no one will be able to recover them,” the message warns.

The cybercriminals demand that ransom be paid in Bitcoin, an anonymous cryptocurrency, which makes it harder to trace their activity and seize malware control servers, according to Russian computer security software company Kaspersky Lab.

Hackers set the ransom at 0.1599 Bitcoin, or roughly US$96, according to a screenshot posted by GDN9, a game news website.

Bkav said it has developed antivirus software that can kill the CTB Locker. The software, which does not require installation, is available for free at bkav.com.vn/download/BkavRS.exe.

“Users are advised not to open attachments from emails of unknown origin, or do so under Safe Run mode to protect their computers,” the company recommended. 

Like us on Facebook or follow us on Twitter to get the latest news about Vietnam!