The variant, classified as Win32.GpCode.ae., is currently spreading across the Russia. Once downloaded, the virus encrypts data on the victim’s PC and is only decrypted by the virus writer once demands for money are met.
This virus differs from earlier variants in that it encrypts the user’s data using RSA 260-bit, a more secure encryption algorithm than RSA 67-bit, as previously used.
The body of the email reads:
Some files are coded by RSA method.
To buy decoder mail: k47674@mail.ru
with subject: REPLY
Experts said the virus could spread out from eastern Europe and hit the west very soon.
“This is the latest in a series of GpCode variants and we’re seeing growth in this type of cyber blackmail,” said David Emm, senior technology consultant, Kaspersky Lab.
“The virus has so far been confined to Russia. However, since we have seen isolated incidents of ‘ransomware’ in the U.K., users should be on their guard against this potential threat.”
