{"id":5388,"date":"2021-11-02T17:11:06","date_gmt":"2021-11-02T08:11:06","guid":{"rendered":"https:\/\/automaton-media.com\/en\/?p=5388"},"modified":"2021-11-02T17:20:16","modified_gmt":"2021-11-02T08:20:16","slug":"20211102-5388","status":"publish","type":"post","link":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/","title":{"rendered":"Ransomware targeting Japanese Minecraft cheaters has been found, demanding just $17"},"content":{"rendered":"\n

Publication date of the original Japanese article<\/a>: 2021-11-02 11:29 (JST)
Translated by. Ryuki Ishii<\/em><\/p>\n\n\n\n


A variant of the Chaos ransomware targeting Japanese Minecraft<\/strong><\/em> users has been reported by cybersecurity firm Fortinet<\/a> (via PC Gamer<\/a>). The malware disguises itself as a list of \u201calt (alternative) accounts\u201d and demands 2,000 yen (approx. $17) to fix the files.<\/p>\n\n\n\n

The ransomware is reportedly being distributed through online Minecraft<\/em> forums under the guise of a list of alt accounts, which are used by players for various purposes, including cheating and trolling. Like most online games, Minecraft\u2019s multiplayer servers are not immune to such behaviors. Cheat tools are used to gain an unfair advantage in PvP servers, and players harass others using the in-game chat and other means.<\/p>\n\n\n\n

Last year, Mojang gave moderators the ability to perma-ban players for breaking the game\u2019s community guidelines (official website<\/a>). Alt accounts are used to avoid getting one\u2019s main account banned, while continuing to engage in malicious activities.  <\/p>\n\n\n\n

According to Fortinet, the malware file is an executable, \u201cbut it uses a text icon to fool potential victims into thinking it is a text file full of compromised usernames and passwords for Minecraft.\u201d Once the damage is done, a ReadMe.txt file demands the victim to pay a ransom. The text is in Japanese only, suggesting that it is indeed targeting Japanese Minecraft players.

<\/p>\n\n\n\n

\"\"
image credit: Fortinet<\/figcaption><\/figure>\n\n\n\n


What is interesting about this ransomware is its behavior and ransom amount. When the ransomware is executed, it encrypts all files in the compromised PC that are smaller than about 2.1MB (2,117,152 bytes to be exact) and holds them hostage. On the other hand, Files larger than 2.1MB with specific file extensions \u201care filled with random bytes so the victim will not be able to get those files back even if the ransom is paid.\u201d<\/p>\n\n\n\n

The ransom amount demanded is 2000 yen (approx. $17). This is a very low amount for ransomware. The culprit accepts payment in bitcoin, and in some cases, prepaid cards. There is also a rather polite apology in Japanese stating, \u201cWe can only respond on Saturdays (JST). We apologize for any inconvenience caused.\u201d<\/p>\n\n\n\n

Fortinet concludes that \u201cdespite its cheap ransom demand, its ability to destroy data and render it unrecoverable makes it more than a mere prank to annoy Japanese Minecraft gamers.\u201d <\/p>\n\n\n\n

I think it\u2019s also possible that this malware is mainly aimed at young Japanese kids, considering the low ransom, and the fact that prepaid cards can be easily purchased at convenience stores, which Japan has an abundance of. <\/p>\n\n\n\n

Buying and selling Minecraft<\/em> accounts goes against the game\u2019s Terms of Service. And since potential victims are likely trying to get a hold of alt accounts for malign reasons, you could say it\u2019s their own fault if they get scammed. However, the creation and distribution of ransomware is illegal in Japan, and is generally considered an unacceptable act worldwide.<\/p>\n\n\n\n

Like Fortinet says, \u201cThe best advice is for players to stay off suspicious gaming cheat sites and simply enjoy the game the way it was meant to be played.\u201d



[UPDATE 2021\/11\/02 17:18 JST]
Amended the article headline to avoid misinterpretation.<\/p>\n","protected":false},"excerpt":{"rendered":"

Ransomware targeting Japanese Minecraft cheaters has been found. Disguising itself as a \u201clist of stolen accounts\u201d and demanding just 2,000 yen (around $17).<\/p>\n","protected":false},"author":30,"featured_media":5392,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_gspb_post_css":"","footnotes":""},"categories":[3],"tags":[17],"class_list":["post-5388","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-japan-related-news"],"blocksy_meta":[],"yoast_head":"\nRansomware targeting Japanese Minecraft cheaters has been found, demanding just $17 - AUTOMATON WEST<\/title>\n<meta name=\"description\" content=\"Ransomware targeting Japanese Minecraft cheaters has been found. Disguising itself as a \u201clist of stolen accounts\u201d and demanding just 2,000 yen (around $17).\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware targeting Japanese Minecraft cheaters has been found, demanding just $17 - AUTOMATON WEST\" \/>\n<meta property=\"og:description\" content=\"Ransomware targeting Japanese Minecraft cheaters has been found. Disguising itself as a \u201clist of stolen accounts\u201d and demanding just 2,000 yen (around $17).\" \/>\n<meta property=\"og:url\" content=\"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/\" \/>\n<meta property=\"og:site_name\" content=\"AUTOMATON WEST\" \/>\n<meta property=\"article:published_time\" content=\"2021-11-02T08:11:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-11-02T08:20:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/automaton-media.com\/en\/wp-content\/uploads\/2021\/11\/20211102-181009-header.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Sayoko Narita\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@AUTOMATON_ENG\" \/>\n<meta name=\"twitter:site\" content=\"@AUTOMATON_ENG\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sayoko Narita\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware targeting Japanese Minecraft cheaters has been found, demanding just $17 - AUTOMATON WEST","description":"Ransomware targeting Japanese Minecraft cheaters has been found. Disguising itself as a \u201clist of stolen accounts\u201d and demanding just 2,000 yen (around $17).","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/","og_locale":"en_US","og_type":"article","og_title":"Ransomware targeting Japanese Minecraft cheaters has been found, demanding just $17 - AUTOMATON WEST","og_description":"Ransomware targeting Japanese Minecraft cheaters has been found. Disguising itself as a \u201clist of stolen accounts\u201d and demanding just 2,000 yen (around $17).","og_url":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/","og_site_name":"AUTOMATON WEST","article_published_time":"2021-11-02T08:11:06+00:00","article_modified_time":"2021-11-02T08:20:16+00:00","og_image":[{"width":1200,"height":675,"url":"https:\/\/automaton-media.com\/en\/wp-content\/uploads\/2021\/11\/20211102-181009-header.jpg","type":"image\/jpeg"}],"author":"Sayoko Narita","twitter_card":"summary_large_image","twitter_creator":"@AUTOMATON_ENG","twitter_site":"@AUTOMATON_ENG","twitter_misc":{"Written by":"Sayoko Narita","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/#article","isPartOf":{"@id":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/"},"author":{"name":"Sayoko Narita","@id":"https:\/\/automaton-media.com\/en\/#\/schema\/person\/6ff2721c450e20970538373b7515eaf6"},"headline":"Ransomware targeting Japanese Minecraft cheaters has been found, demanding just $17","datePublished":"2021-11-02T08:11:06+00:00","dateModified":"2021-11-02T08:20:16+00:00","mainEntityOfPage":{"@id":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/"},"wordCount":530,"publisher":{"@id":"https:\/\/automaton-media.com\/en\/#organization"},"image":{"@id":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/#primaryimage"},"thumbnailUrl":"https:\/\/automaton-media.com\/en\/wp-content\/uploads\/2021\/11\/20211102-181009-header.jpg","keywords":["News (Japan-related)"],"articleSection":["News"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/","url":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/","name":"Ransomware targeting Japanese Minecraft cheaters has been found, demanding just $17 - AUTOMATON WEST","isPartOf":{"@id":"https:\/\/automaton-media.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/#primaryimage"},"image":{"@id":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/#primaryimage"},"thumbnailUrl":"https:\/\/automaton-media.com\/en\/wp-content\/uploads\/2021\/11\/20211102-181009-header.jpg","datePublished":"2021-11-02T08:11:06+00:00","dateModified":"2021-11-02T08:20:16+00:00","description":"Ransomware targeting Japanese Minecraft cheaters has been found. Disguising itself as a \u201clist of stolen accounts\u201d and demanding just 2,000 yen (around $17).","breadcrumb":{"@id":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/automaton-media.com\/en\/news\/20211102-5388\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/#primaryimage","url":"https:\/\/automaton-media.com\/en\/wp-content\/uploads\/2021\/11\/20211102-181009-header.jpg","contentUrl":"https:\/\/automaton-media.com\/en\/wp-content\/uploads\/2021\/11\/20211102-181009-header.jpg","width":1200,"height":675},{"@type":"BreadcrumbList","@id":"https:\/\/automaton-media.com\/en\/news\/20211102-5388\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u30db\u30fc\u30e0","item":"https:\/\/automaton-media.com\/en\/"},{"@type":"ListItem","position":2,"name":"Ransomware targeting Japanese Minecraft cheaters has been found, demanding just $17"}]},{"@type":"WebSite","@id":"https:\/\/automaton-media.com\/en\/#website","url":"https:\/\/automaton-media.com\/en\/","name":"AUTOMATON WEST","description":"AUTOMATON is a website that covers the Japanese gaming world. We bring you the news on video games from Osaka and Tokyo.","publisher":{"@id":"https:\/\/automaton-media.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/automaton-media.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/automaton-media.com\/en\/#organization","name":"\u682a\u5f0f\u4f1a\u793e\u30a2\u30af\u30c6\u30a3\u30d6\u30b2\u30fc\u30df\u30f3\u30b0\u30e1\u30c7\u30a3\u30a2","url":"https:\/\/automaton-media.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/automaton-media.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/automaton-media.com\/en\/wp-content\/uploads\/2021\/04\/activegamingmedia_logo.png","contentUrl":"https:\/\/automaton-media.com\/en\/wp-content\/uploads\/2021\/04\/activegamingmedia_logo.png","width":374,"height":190,"caption":"\u682a\u5f0f\u4f1a\u793e\u30a2\u30af\u30c6\u30a3\u30d6\u30b2\u30fc\u30df\u30f3\u30b0\u30e1\u30c7\u30a3\u30a2"},"image":{"@id":"https:\/\/automaton-media.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/AUTOMATON_ENG","https:\/\/www.youtube.com\/channel\/UCabvYnvuUUbbGUrxkaFRgSA"]},{"@type":"Person","@id":"https:\/\/automaton-media.com\/en\/#\/schema\/person\/6ff2721c450e20970538373b7515eaf6","name":"Sayoko Narita","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/automaton-media.com\/en\/wp-content\/uploads\/2023\/12\/Narita2-150x150-1-100x100.jpg","url":"https:\/\/automaton-media.com\/en\/wp-content\/uploads\/2023\/12\/Narita2-150x150-1-100x100.jpg","contentUrl":"https:\/\/automaton-media.com\/en\/wp-content\/uploads\/2023\/12\/Narita2-150x150-1-100x100.jpg","caption":"Sayoko Narita"},"description":"JP AUTOMATON writer","url":"https:\/\/automaton-media.com\/en\/author\/seiji-narita\/"}]}},"_links":{"self":[{"href":"https:\/\/automaton-media.com\/en\/wp-json\/wp\/v2\/posts\/5388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/automaton-media.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/automaton-media.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/automaton-media.com\/en\/wp-json\/wp\/v2\/users\/30"}],"replies":[{"embeddable":true,"href":"https:\/\/automaton-media.com\/en\/wp-json\/wp\/v2\/comments?post=5388"}],"version-history":[{"count":26,"href":"https:\/\/automaton-media.com\/en\/wp-json\/wp\/v2\/posts\/5388\/revisions"}],"predecessor-version":[{"id":5426,"href":"https:\/\/automaton-media.com\/en\/wp-json\/wp\/v2\/posts\/5388\/revisions\/5426"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/automaton-media.com\/en\/wp-json\/wp\/v2\/media\/5392"}],"wp:attachment":[{"href":"https:\/\/automaton-media.com\/en\/wp-json\/wp\/v2\/media?parent=5388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/automaton-media.com\/en\/wp-json\/wp\/v2\/categories?post=5388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/automaton-media.com\/en\/wp-json\/wp\/v2\/tags?post=5388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}