Fortnite has about 250 million registered gamers, and this makes it a great target for cybercriminals.
Researchers at cloud security firm Cyren have discovered a malware that markets itself as a Fortnite hack
Promising to aid gamers win the game, using two cheats in one package: aimbot (an autoaiming tool) and WH (aka ESP, a cheat for discovering other players’ locations in the game), the package is really a ransomware in disguise.
Known as 'Syrk', the malware that goes with the name SydneyFortniteHacks.exe, has the intention to lock gamers out of their systems and demand ransom in return.
Describing the ransomware, Maharlito Aquino and Kervin Alintanahin from Cyren warned that "we expect it to possibly be distributed via an upload to a sharing site and the link posted in Fortnite users in forums."
Syrk disguised itself as an Fortnite game hack, which should give Fortnite players an advantage when facing their opponents.
But instead of the files intended for the cheat, the package comes as a 12MB executable file that holds several files in it. Once ran, the malware will download all the necessary files to attack the victim.
The first thing it does, is connecting itself to the Command-and-Control server, and tweaks Windows registry to disable Windows Defender and User Access Control. Some Windows resources that could prevent or locate Syrk are monitored closely, including the Task Manager, Process Monitor, and Process Hacker.
After finishing all the above, Syrk can then encrypt files inside the victims' computer.
This includes images, videos, documents, music, as well as ZIP and RAR archives, Photoshop and Microsoft Visual Studio files. All of those files are encrypted and given a .syrk extension.
The malware then display a message to the victim, telling that their system has been compromised and demand ransom.
That warning message that has a Guy Fawkes mask in the background, states that if the payment isn't made before the displayed two-hour countdown timer reaches zero, then the files made ransom would be deleted, followed by more files on the Desktop and later, the Documents folders.
According to Cyren, victims should never pay ransom.
It was previously reported that Syrk's developers have created similar but older ransomware called 'Hidden-Cry' This particular malware has its source code available on the internet, allowing security researchers to learn its attack methods.
Hidden-Cry uses a similar method used by Syrk, and this is why the researchers at Cyren said that: "We believe it is possible for victims to recover deleted files, given the simple method used to delete the files."
Those researchers have also suggested two possible methods that can be used to decrypt the encrypted files without paying any ransom.
The first method, is to use the decrypting tool in the malware download itself. That file which goes with the name dh35s3h8d69s3b1k.exe, can be "used to create a PowerShell script based on the shared source of the Hidden-Cry decrypter," according to Cyren.
The second method is executing some files within the malware. Cyren researchers found that the malware drops some files which apparently contain the ransomware decryption password, when it first installs itself. These files can include the tool needed to remove all the malicious files it installed.
The popularity of Fortnite has given it a bad name, mostly because of its gamers' behavior.
For example, a cracking forum managed to hack a rival cracking group, and published a database containing more than 350,000 messages. And among the messages exposed, there were several gamers discussing the sale of "freshly cracked Fortnite accounts with skins," as well as advice for changing the email of those cracked accounts.
Then in earlier this August, it was reported that malware called 'Baldr' was distributed by disguising itself has a Fortnite cheat hacks. Baldr as a matter of fact, is a gaming website which can steal login credentials and credit card data.
