TeslaCrypt Ransomware Targets File Encryption of Nearly 20 Desktop Games

Ransomware continues to be a major annoyance and initiator of serious system damage due to the encryption capabilities of recent threats. The latest crypt-ransomware types, such as TeslaCrypt Ransomware, are targeting over 50 custom game files that belong to upwards of 20 popular products.

Computer security researchers are already faced with a new epidemic of crypto-ransomware threats, which are malware parasites that take hold of files on a Windows PC and encrypt those files making them unusable or damaged for good. In the research conducted around one of the many crypt-ransomware threats, researchers have uncovered cases where the TeslaCrypt threat is putting over 50 custom game files belonging to about 20 different computer games in its crosshairs.

TeslaCrypt Ransomware Threat Message Screen Shot Example

In TeslaCrypt's attacks, it can take game files hostage where data on those files, such as saved games, maps, mods and user profile data, is compromised. In recent discoveries of TeslaCrypt performing these actions, it was found that the threat attempts to pass itself off as the famous CryptoLocker Ransomware threat, which is known as one of the originators of crypto-ransomware types. At one time, CryptoLocker was distributed by the GameOver Zeus botnet, which was later immobilized by law enforcement and other private security entities last year.

The similarities found by researchers when comparing CryptoLocker to TelsaCrypt were very few. Even so, less than 10% of their makeup is claimed to be the same. This discovery has led us to believe that the cybercrooks aiming TeslaCrypt at game files are riding the coat tail of CrytoLocker's popularity.

The perpetrators behind TeslaCrypt are looking to cash in big on it playing an aggressive money extortion scheme through holding gaming files hostage while it asks that a fee of $500 to $1000 be paid to allegedly unlock the encrypted gaming files.

TeslaCrypt and its claim of encrypting files may be more of a façade than an actual strong encryption using the a so-called 2048-bit RSA key employment. We know with a certainty that CryptoLocker actually encrypts files and in some instances damaged those files. On the other hand, dealing with TeslaCrypt, it seems it is more of a passive threat that talks a stronger game than it plays.

The games currently affected by TeslaCrypt remain to be single-player desktop computer titles, such as Call of Duty, Half-Life 2, League of Legends, Assassin's Creed, Minecraft, The Elder Scrolls (Skyrim-related files), World of Warcraft, World of Tanks and WarCraft 3.

Researchers have also found that TeslaCrypt is affecting files that belong to the Steam platform and game development software from RPG Maker, Unreal Engine and Unity3D. It is possible we may see future gaming files from those developers be among the ones targeted by TeslaCrypt if it is able to continue on the same destructive path.

TeslaCrypt Ransomware Targeted Files Types number of extensions chart - Source: Bromium

The chart above, sourced from the security firm Bromium, shows the extension file types that are locked by TeslaCrypt. Among them, you will see an exponential increase for gaming files over any other type of targeted file. It is safe to say TeslaCrypt is a crypto-ransomware threat that primarily targets gaming files.