ElGato Ransomware Targets Androids, Locks SD Card Data and Steals SMS Messages

The ElGato ransomware family, recently discovered by Intel McAfee researchers, targets Android devices, where it locks the user's device, encrypts his files, and even steals SMS messages when commanded.

The ransomware operates based on a control panel from which the crooks send commands to infected devices.

Intel McAfee researchers say that ElGato checks for new commands from the C&C server at regular intervals. These commands are sent to the ransomware in clear HTTP, without encryption.

ElGato comes with an easy to use Web-based control panel

Some of the commands supported include the ability to forward and delete all SMS messages, send a message from the infected device, encrypt the files on the SD card, or encrypt files from at a specific path. All encrypted files will feature the .enc file extension at the end.

Additionally, the crook can also lock the user's screen, and additionally order the ransomware to decrypt all previously encrypted f...