A threat actor is distributing fake Windows and Android installers for the Cyberpunk 2077 game that is installing a ransomware calling itself CoderWare.
To trick users into installing malware, threat actors commonly distribute them as gamer installers, cheats, and cracks for copyrighted software.
This week, Kaspersky malware analyst
Tatyana Shishkova discovered an Android ransomware masquerading as a mobile version of the Cyberpunk 2077 game. The game was being distributed from a fake website impersonating the legitimate Google Play Store.
Shishkova
tweeted that the CoderWare ransomware utilizes a hardcoded key, which means a decryptor can be made if necessary to recover files for free.
"RC4 algorithm with hardcoded key (in this example - "21983453453435435738912738921") is used for encryption. That means that if you got your files encrypted by this #ransomware, it is possible to decrypt them without paying the ransom."
