Blackmail software is disguised as Windows update, which can encrypt files and delete backups.

CTOnews.com, July 10 (Xinhua) recently, a ransomware called "Big Head" is disguised as an Windows update to infect users' computers, not only encrypting files, but also deleting backups. Two variants of this malware have been discovered and analyzed by security research firms Fortinet and Trend Micro.

According to researchers at FortiGuard Labs, a Fortinet security research group, the first variant of Big Head (variant A) displays a fake Windows update interface after infecting the computer, making users think the computer is being updated. It actually encrypts the file in the background, which takes about 30 seconds.

Trend Micro reveals a second variant of Big Head (variant B), which uses a PowerShell file called "cry.ps1" to encrypt files in the infected system. To make matters worse, this variant can also detect whether the computer is running in a virtual environment, such as Virtual Box or VMware, and delete Volume Shadow copy Service (VSS) backups, making it impossible for users to recover data.

CTOnews.com partners can find more technical details and Big Head's IOC (compromise indicators) on Fortinet and Trend Micro.