GoodWill Ransomware victims have to perform socially driven activities to decryption their data

May 30, 2022 By Pierluigi Paganini


ⓘ
Researchers discovered a new ransomware family called GoodWill that asks victims to donate the ransom for social causes.

CloudSEK’s Threat Intelligence Research team has disclosed a new ransomware strain called GoodWill, that demands victims the payment of a ransom through donations for social causes and financially helping people in need.

ⓘ

“The ransomware group propagates very unusual demands in exchange for the decryption key. The Robin Hood-like group claims to be interested in helping the less fortunate, rather than extorting victims for financial motivations.” reads the analysis published by CloudSEK. “The group’s multiple-paged ransom note suggests that victims perform three socially driven activities to be able to download the decryption key.”


The GoodWill ransomware is written in .NET, in order to evade detection it is packed with UPX packers and sleeps for 722.45 seconds before starting its activity.

The researchers attribute the attack to a threat actor based in India. Ransomware operators request the victims to perform three socially driven activities in exchange for the decryption key.

Researchers observed that the ransomware code is based on the HiddenTear open-source ransomware.

Victims have to donate new clothes to the homeless, record their action, and post it on social media. In addition, the victims can accompany less fortunate children to Dominos, Pizza Hut or KFC for a treat, take pictures and videos, and post them on social media.

The last action for the victims consists of providing financial assistance to anyone who needs urgent medical attention, but cannot afford it, at a nearby hospital, recording audio, and sharing it with the operators.

“Once all three activities are completed, the victims should also write a note on social media (Facebook or Instagram) on “How you transformed yourself into a kind human being by becoming a victim of a ransomware called GoodWill.” said the researchers. “Since there are no known victims/ targets for the ransomware group, their Tactics, Techniques and Procedures remain unknown.”

The researchers also shared indicators of compromise (IoCs) for this ransomware.