Fatboy Ransomware: New Attack Ties Ransom To Price Of Big Mac

A new Russian-based ransomware-for-hire service called Fatboy has been spreading online, and will adjust a victim’s ransom cost based on the regional price of a McDonald’s Big Mac, according to new research.

Recorded Future, a U.S.-based cybersecurity firm, first discovered the ransomware service, which has been made available to purchase and use on Exploit, a Russian-language online forum.

Read: Cyberattacks: Phishing, Ransomware Attacks Rose In 2016, Symantec Reports

Fatboy automatically adjusts its ransom demands according to the Big Mac index, a measurement created by the Economist magazine to determine if the official international monetary exchange rates line up with the price charged for a specific product—in this case, a Big Mac.

When Fatboy is used on a victim’s computer, it encrypts their files and demands a ransom in order to decrypt them and restore the victim’s access to their device. In order to determine the ransom, the malicious service examines the Big Mac index. Victims in areas with a higher cost of living are charged more.

According to the index, a Big Mac cost $5.06 in January 2017 in the U.S. By contract, in China it was only $2.83 at market exchange rates. Since the cost of the Big Mac is higher in the U.S., a victim in the U.S. would pay more than one in China.

Since Feb. 7, the author of the Fatboy ransomware service has supposedly earned at least $5,321 USD from their own campaigns using the product. They have since started offering the service to others to purchase and use.

Read: Digital Geneva Convention: Microsoft Calls For Framework For Cyber Warfare Between Nation-States

Recorded Future noted the attack’s sliding scale ransom system is unique, and presents new challenges for businesses and individuals as it shows an increased interest in customized and targeted attacks.

Another detail that makes Fatboy and its provider stand out in the growing world of ransomware is how transparent they are about the service.

“Purchasers of the Fatboy RaaS partner directly with the author of the malware and not through a third party like many other cyber criminals prefer. These partners also receive payment instantly when a victim pays their ransom, adding another level of transparency to this partnership,” Recorded Future said.

While some of its features may make Fatboy stand out, ransomware as a whole has become increasingly common in recent years.

A recent report from Symantec found there were more ransomware attacks in 2016 than in any year prior, and those attacks netted more money from victims than ever before. More than 100 new ransomware families were found in the wild in 2016 alone.

The average ransom price also spiked in 2016 by 266 percent with the attackers demanding an average of $1,077 per victim, up from $294 in 2015. The attacks found their way onto computer systems of hospitals and local governments, leading to considerable inconveniences and risk of more than just financial damage.