Citadel Malware Continues to Deliver Reveton Ransomware in Attempts to Extort Money

The Federal Bureau of Investigation’s Internet Crime Complaint Center (IC3) and the Department of Homeland Security (DHS) have recently received complaints regarding a ransomware campaign using the name of the DHS to extort money from unsuspecting victims.

In May 2012, the IC3 posted an alert about the Citadel malware platform used to deliver ransomware known as Reveton. The ransomware directs victims to a download website, at which time it is installed on their computers. Ransomware is used to intimidate victims into paying a fine to “unlock” their computers. The ransomware has been called “FBI Ransomware” because it frequently uses the FBI’s name including the names of FBI programs such as InfraGard and IC3. Similar ransomware campaigns have used the names of other law enforcement agencies such as the DHS.

http://liarcatchers.com/fraud_investigation.html

As in other variations, the ransomware using the name of the DHS produces a warning that accuses victims of violating various U.S. laws and locks their computers. To unlock their computers and avoid legal issues, victims are told they must pay a $300 fine via a prepaid money card.

This is not a legitimate communication from law enforcement, but rather is an attempt to extort money from the victim. If you have received this or something similar, do not follow the instructions in the warning and do not attempt to pay the fine.

It is suggested that you;

Contact a reputable computer expert to assist with removing the malware.
File a complaint at www.IC3.gov.
Keep operating systems and legitimate antivirus and antispyware software updated.

An investigation by Monmouth County’s Superstorm Sandy Fraud Task Force has resulted in a Toms River contractor being charged with working while unregistered and uninsured, Acting Monmouth Prosecutor Christopher Gramiccioni said in a press release Friday.

Shane Wood, 48, was charged with providing a fraudulent insurance certificate and working as an unregistered contractor after state authorities revoked his registration.

“Superstorm Sandy was harsh on many residents in Monmouth County and across New Jersey, we cannot permit anyone to take advantage of people in such a vulnerable situation,” Gramiccioni said. “There are laws and rules in place to protect these vulnerable citizens and our Superstorm Sandy Fraud Task Force is taking on anyone who wants to challenge those laws and rules for doing business in Monmouth County.”

http://liarcatchers.com/fraud_investigation.html

Wood was arrested Thursday after an investigation by the Superstorm Sandy Fraud Task Force revealed he sub-contracted with a general contractor to perform roof repair work on a Monmouth Beach property in late-January 2013 as the principal of Reliable Roofing and Siding, Gramiccioni said.

Gramiccioni said the general contractor required Wood’s company to provide a Certificate of Liability Insurance reflecting it was covered for New Jersey Workers’ Compensation Insurance.

Wood transmitted a document indicating Reliable Roofing and Siding was covered by the John Hill Insurance Company, but the insurance company said Wood supplied a fraudulent document, Gramiccioni said.

The general contractor contacted the Superstorm Sandy Fraud Task Force, prompting the criminal investigation.

Wood is charged with Forgery, Uttering a Forged Instrument, Failure to Register with the state Division of Consumer Affairs, and Failure to Provide a Written Contract.

He was released pending a future court date after posting $10,000 bail, as set by Monmouth County Superior Court Judge Honora O’Brien Kilgallen.

The case is being prosecuted by Assistant Monmouth County Prosecutor Andrew S. Fried, of the Office’s Financial Crimes and Public Corruption Bureau and coordinator of the Superstorm Sandy Fraud Task Force.