Cyberpunk 2077 – Just as we tough that 2020 couldn’t get any weirder…a group of researchers discovered a ransomware strain being distributed camouflaged as Windows and Android installers for Cyberpunk 2077.
Called CoderWare, this malware is targeting gullible user looking for installers, cheats and cracked copies of CD PROJEKT RED latest and most controversial title.
Earlier this week,malware analyst Tatyana Shishkova discovered an Android ransomware masquerading as a mobile version of the Cyberpunk 2077 game. The game was being distributed from a fake website impersonating the legitimate Google Play Store.
As she tweeted, CoderWare utilizes a hardcoded key, which means a decryptor can be made if necessary to recover files for free.
This ransomware is the same as the one discovered by MalwareHunterTeam in November that was disguised as a Windows Cyberpunk 2077 installer.
Like the Android version, this ransomware calls itself CoderWare but is a variant of the BlackKingdom ransomware.
The Windows variant was a python compiled executable that would encrypt a victim’s files and append the .DEMON extension to encrypted file’s names.
BlackKingdom ransomware claim to fame was it’s use of exploit of unpatched versions of Pulse Secure VPN classified as CVE-2019-11539.
This vulnerability is present in Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1.
In short, the admin web interface allows an authenticated attacker to inject and execute commands.
This vulnerably has been patched in April 2019 updates, however, even after the security flaw had become public, many enterprises delayed updating their software, thereby leaving their systems vulnerable to attacks.
It is not known if the Windows version use a hardcoded key at this time.
As you can see, when attempting to install copyrighted software for free, you face huge risks of malware infections. This risk is even more significant when you try to install Android apps from third-party app stores.