Lucy Malware

The Lucy Malware is a newly developed piece of Android malware that appears to be rented out by its authors. Cybercriminals often take advantage of malware-as-a-service projects since they can be paid without interacting with their victims – they simply sell their tools to other cybercriminals. There is not enough information to determine the approximate number of cybercriminals that have taken advantage of the Lucy Malware for Android, but it is safe to assume that the number will be increasing in the near future rapidly. Surprisingly, so far the Lucy Malware has been used against targets residing in ex-USSR countries – the malware ensures that it will not run outside of this region by checking the country code of the infected device.

The Lucy Malware Locks Files on Android Devices

The primary purpose of the Lucy Malware is to act as a file-locker that then extorts the victim for money. The threat is able to encrypt files stored on the phone and the SD card, and it does not choose when it comes to file types – it will encrypt any file that can be accessed. After the attack is complete, the Lucy Malware may display a ransom message, which appears to try to trick victims into thinking that their devices have been locked by the FBI – the crooks inform the victims that their devices were locked because they were visiting illicit adult sites. The attackers then demand a 'payment penalty' of $500 to be paid – surprisingly, they do not accept cryptocurrency payments and, instead, they want the victim to provide them with credit card information.

The Perpetrators Pose as FBI Employees

The Lucy Malware is not decryptable for free, and its attack can be very damaging. The threat is likely to be distributed via various methods – social media profiles and pages, fake text messages, fake downloads and 3rd-party application stores. The best way to protect your Android is to invest in a regularly updated Android anti-virus application that will manage to identify threats like the Lucy Malware before they cause any damage.

It is highly unprobable that the authors of the Lucy Malware will provide their victims with a decryption service in exchange for their credit card information – needless to say, supplying cybercriminals with your financial data is a huge mistake. In addition to encrypting files, the Lucy Malware also opens a reverse shell on the compromised Android device, therefore allowing the attacker to execute remote commands.