Lockerpin, the first known Android lock-screen ransomware

Lockerpin is the first known Android lock-screen ransomware to set a phone’s PIN lock that is targeting mainly US mobile users.

Once again here we are to discuss a new mobile ransomware, this time the malicious Android app dubbed Android/Lockerpin.A locks out victims by changing lock screen PIN until owners pay a $US500 ransom.

Android/Lockerpin.A, the app first tricks users into granting it administrator privileges by displaying a bogus patch installation window on top of an activation notice.

ransomware PIN change Lockerpinransomware PIN change Lockerpin

When victims click on the “continue” button, they grant the malicious app the administrator privileges which allow the app to modify the Android settings.

The Lockerpin ransomware changes the PIN used to unlock the screen lock, then the user only can do a factory reset to regain control over the smartphone.

“The trojan app has obtained administrator rights silently and now can lock [the] device—and even worse, it set[s] a new PIN for the lock screen. Not long after, the user will be prompted to pay a $US500 ransom for allegedly viewing and harboring forbidden pornographic material.” wrote in a blog post Lukas Stefanko, researcher at Eset firm. 

Differently from other ransomware, restarting the mobile device in safe mode will not allow the owner to disable the malicious Lockerpin app. According to ESET, Lockerpin is the first known Android lock-screen ransomware to set a phone’s PIN lock. It relies on the fear of the users to lose all of their data due to the factory reset.

“In previous Android LockScreen Trojans, the screen-locking functionality was usually achieved by constantly bringing the ransom window to the foreground in an infinite loop. While various self-defense mechanisms were implemented to keep the device user locked out, it wasn’t too difficult to get rid of the malware thus unlocking the device by using Android Debug Bridge (ADB) or deactivating Administrator rights and uninstalling the malicious application in Safe Mode.” continues the post.

Lockerpin is distributed through third-party app stores and masquerades as an app for providing adult content.

According to data provided by ESET, most of the infected Android devices are in the USA (75%), with a percentage share of over 75 per cent.

“This is part of a trend where Android malware writers are shifting from mostly targeting Russian and Ukrainian users to largely targeting victims in America, where arguably they can make bigger profits.” states ESET.

When malware is spread through official channels, App store and Play store, the situation could be much more dangerous for users due to the larger audience impacted as happened recently with the Android Adult Player malicious app.

Pierluigi Paganini

(Security Affairs – Lockerpin, ransomware)

 

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Silent Ransom Group targeting law firms, the FBI warns

FBI warns Silent Ransom Group has targeted U.S. law firms for 2 years using callback…

9 hours ago

Leader of Qakbot cybercrime network indicted in U.S. crackdown

The U.S. indicted Russian Rustam Gallyamov for leading the Qakbot botnet, which infected 700K+ devices…

14 hours ago

Operation RapTor led to the arrest of 270 dark web vendors and buyers

Law enforcement operation codenamed 'Operation RapTor' led to the arrest of 270 dark web vendors…

2 days ago

Chinese threat actors exploited Trimble Cityworks flaw to breach U.S. local government networks

A Chinese threat actor, tracked as UAT-6382, exploited a patched Trimble Cityworks flaw to deploy…

2 days ago

U.S. CISA adds a Samsung MagicINFO 9 Server flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Samsung MagicINFO 9 Server vulnerability to its…

2 days ago

New Signal update stops Windows from capturing user chats

Signal implements new screen security on Windows 11, blocking screenshots by default to protect user…

2 days ago