The malware surfaced just days after health officials in Canada announced the launch of a tracing app in the fight against COVID-19.
Researchers from ESET said this week that the ransomware emerged only a few days after Health Canada announced the release of COVID Alert, which will first be tested in Ontario before rolling out nationwide.
While the official app is not due to be made available to mobile device users until next month at the earliest, cyberattackers are trying to capitalize on the government’s announcement with an Android package of their own — marketed as Canada’s official COVID-19 tracing app, but hiding a malicious secret.
According to the cybersecurity firm, two websites offered what appeared to be Health Canada’s tracing app. However, the now-defunct domains — tracershield[.]ca and covid19tracer[.]ca — were actually hosting APKs that, when downloaded, installed the CryCryptor ransomware on Android devices.
The ransomware first came to ESET’s attention by way of a tweet by a Twitter user under the handle @ReBensk. While the alert warned that the APKs were hiding a banking Trojan, upon further examination, the malware turned out to be the new ransomware.
Source : New ransomware masquerades as COVID-19 contact-tracing app on your Android device