Lucy Ransomware Now Threatens Android Users With FBI Fine

  •  
  •  
  •  
  • 1
  •  
  •  
  •  
    1
    Share

The infamous Lucy ransomware has now appeared again to prey on users. This time, Lucy ransomware threatens Android users with a threat seemingly from the FBI.

Lucy Ransomware Targets Android Users

Researchers from Check Point have highlighted Lucy ransomware back in action. This time, Lucy ransomware targets Android users while impersonating the FBI.

As explained in a recent post, Lucy first caught the attention of Check Point back in 2018. And now, after two years, the ransomware that serves as malware-as-a-service (MaaS) back with improvised capabilities to target Android devices.

Briefly, the malware is spreading around mainly through social media links and instant messaging apps. The researchers found at least 80 different samples carrying this Lucy variant.

Upon entering the target device, the malware tricks the user to gain access to the Android Accessibility Service. As stated in the post,

It displays a message asking the user to enable SVO (Streaming Video Optimization).  By clicking ‘OK’, the user grants the malware the permission to use the accessibility service. Now Lucy is ready to initiate its malicious plan to encrypt the data on the victim’s device.

This then lets the malware take control of the smartphone’s screen and WiFi, keeping both ‘On’.

After that, Lucy starts encrypting all files. Once verified, it displays the ransom note via the device’s browser, which appears as a notice from the US FBI. This notice may suffice into scaring the victim to pay the ransom which, to them, seems a fine for cybercrime.

Below is a copy of the ransom note.

Lucy ransomware ransom note
Source: Check Point Research

The malware performs other activities on the device. Some of its capabilities include making calls to the C&C server number, send a list of all installed apps to the C&C, and, the most peculiar one is to display a message to the victim regarding a failed payment.

Ransom Not Demanded In Bitcoins

Although Lucy typically behaves like any other ransomware, what makes it unique is the way it asks payment. While the attackers behind most other ransomware demand ransom in Bitcoins, Lucy Gang asks for a payment of $500 via the victim’s credit card.

It seems, through this strategy by asking payments through credit cards, the attackers can gather victim’s payment card data, which they can exploit in the future as well.

Certainly, this ransomware attack reiterates the need for vigilance while installing apps on mobile phones. Users must always ensure that they only download apps from official stores and trusted developers. Moreover, users should also keep their Android devices secure by ensuring prompt updates, using a robust antivirus, and employing safe browsing habits.

Let us know your thoughts in the comments.

The following two tabs change content below.

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Do NOT follow this link or you will be banned from the site!