A new ransomware program has been discovered that demands victims perform good deeds, instead of paying Bitcoin, to free their computers.
The ransomware comes from a group called Goodwill, according to Indian security firm CloudSEK, which discovered the program in March. “As the threat group’s name suggests, the operators are allegedly interested in promoting social justice rather than conventional financial reasons,” CloudSEK wrote in a Tuesday report.
The program operates like other ransomware strains by encrypting all the files on a PC and then posting an extortion message on the screen. However, Goodwill ditches requiring the victim to pay up in order to receive the decryption key.
Instead, the ransomware program shows a message that says: “Team Goodwill is not hungry of Money and Wealth but kindness.” The program will then demands the victim perform three good deeds for the poor in return for receiving a decryption key.
The three acts include donating clothes to the needy, buying food for children, and helping someone at a hospital pay their medical bills. During each act, the victim must take photos and videos and post the content on social media.
In addition, the victim must send the ransomware group an email with links to the social media posts, so the operators of Goodwill can confirm each of the good deeds was completed. The hackers then promise they’ll send a decryption tool along with a video tutorial on how the victim can recover all their files.
CloudSEK investigated the program and uncovered evidence someone in India created the ransomware, citing the hacker-registered email address, IP addresses, and a string of code in the program written in Hindi. Goodwill also shares some code overlap with HiddenTear, an open-source ransomware program designed for educational purposes.
It’s certainly unusual to see a ransomware strain like Goodwill. But the program may just be a pilot project from some unknown user. So far, no victims have been found infected with Goodwill, according to CloudSEK. Most antivirus programs will also flag the program as a malicious threat.