Pirate Bay visitors infected with crypto-ransomware via bad ads
The message Pirate Bay users may have seen if they have been hit by a malicious ad.
Visitors to The Pirate Bay may now be tossing up whether or not to pay to decrypt their files after the torrent site hosted ransomware-barbed ads over the weekend.
According to security firm Malwarebytes, the chief threats behind the attack on Pirate Bay users were the Magnitude exploit kit and a relatively new ransomware subscription service, Cerber.
Ransomware attackers have been on a month-long malvertising rampage, targeting visitors to numerous porn and torrent sites to lead them to the Magnitude exploit kit.
The attack tool chiefly exploits vulnerable browsers and Adobe's Flash Player plugin, and has of late been delivering the Cerber ransomware.
Malvertisers place fraudulent ads with third-party ad networks, with the aim of having them distribute the ads to high-traffic sites. The attack on Pirate Bay users relied on a 'pop-under' window to silently redirect visitors to the Magnitude exploit kit, according to Malwarebytes researcher Jerome Segura.
Although malvertising attackers have hit a number of torrent sites over the past month, as noted by TorrentFreak, this weekend's premier of the sixth season of Games of Thrones triggered a huge spike in BitTorrent activity. The attackers may have been trying to cash in on a surge in traffic to The Pirate Bay.
However, The Pirate Bay has millions of users in any case, making it a rich hunting ground, regardless of the popular TV show's premiere.
The Cerber ransomware grabbed headlines in March after it was discovered that it used a text-to-speech synthesizer to read out aloud the phrase: "Your documents, photos, databases and other important files have been encrypted."
The Pirate Bay visitors infected with Cerber are asked to pay 1.25 bitcoin within the first seven days and after that 2.48 bitcoin. At today's exchange rate this equals $578 and $1,156 respectively. Unlike for certain other crypto-ransomware variants, there is no decryption service available for Cerber.
As Malwarebytes notes in its analysis of Cerber, the malware subscription service can be customized to suit different language regions, or blacklisted to avoid infecting machines in certain countries.
While ransomware has traditionally been more commonly delivered via web attacks, more recently attackers have turned to phishing email, too.