Connect with us

E-Business

ESET Researchers Spot DoubleLocker ‘Innovative’ Android Ransomware

Published

on

Kindly share this post

By peter oluka

ESET researchers have spotted the first-ever ransomware misusing Android accessibility services. On top of encrypting data, it also locks the device.

Detected by ESET products as Android/DoubleLocker.A, the ransomware is based on the foundations of a particular banking Trojan, known for misusing accessibility services of the Android operating system.

However, DoubleLocker doesn’t have the functions related to harvesting users’ banking credentials and wiping out their accounts. Instead, it has received two powerful tools for extorting money from its victims.

DoubleLocker can change the device’s PIN, preventing victims from accessing their devices, and also encrypts the data it finds in them – a combination that has not been seen previously in the Android ecosystem.

“Given its banking malware roots, DoubleLocker may well be turned into what could be called ransom-bankers. Two-stage malware that first tries to wipe your bank or PayPal account and subsequently locks your device and data to request a ransom… Speculation aside, we spotted a test version of such a ransom-banker in the wild as long ago as May, 2017,” comments Lukáš Štefanko, the ESET malware researcher who discovered DoubleLocker.

Distribution

DoubleLocker spreads in the very same way as its banking parent does. It is distributed mostly as a fake Adobe Flash Player through compromised websites.

Once launched, the app requests activation of the malware’s accessibility service, named “Google Play Service”. After the malware obtains the accessibility permissions, it uses them to activate device administrator rights and set itself as the default Home application, in both cases without the user’s consent.

“Setting itself as a default home app – a launcher – is a trick that improves the malware’s persistence. Whenever the user clicks on the home button, the ransomware gets activated and the device gets locked again. Thanks to using the accessibility service, the user doesn’t know that they launch malware by hitting Home,” explains Štefanko.

Locking Both Device And Data

DoubleLocker, once executed on the device, creates two reasons for the victims to pay.

First, it changes the device’s PIN, effectively blocking the victim from using it.  The new PIN is set to a random value which the attackes neither store nor send anywhere, so it’s impossible for the user or a security expert to recover it. After the ransom is paid, the attacker can remotely reset the PIN and unlock the device.

Second, DoubleLocker encrypts all files from the device’s primary storage directory. It utilizes the AES encryption algorithm, appending the extension “.cryeye”. “The encryption is implemented properly, which means that, unfortunately, there is no way to recover the files without receiving the encryption key from the attackers,” says Štefanko.

The ransom has been set to 0.0130 BTC (approximately USD 54 at time of writing) and the message highlights that it must be paid within 24 hours. However, if the ransom is not paid, the data will remain encrypted and will not be deleted.

How To Get Rid Of It?

In the ransom note, the user is warned against removing or otherwise blocking DoubleLocker: “Without [the software], you will never be able to get your original files back”.

To prevent unwanted removal of the “software”, the crooks even recommend disabling the user’s antivirus software.

“Such advice is irrelevant: all those with a quality security solution installed on their devices are safe from DoubleLocker,” explains Štefanko.

The only viable option to clean the device of the DoubleLocker ransomware is via a factory reset.

For rooted devices, however, there is a method to get past the PIN lock without a factory reset. For the method to work, the device needed to be in the debugging mode before the ransomware got activated.

If this condition is met, then the user can connect to the device by ADB and remove the system file where the PIN is stored by Android. This operation unlocks the screen so that the user can access their device. Then, working in safe mode, the user can deactivate device administrator rights for the malware and uninstall it. In some cases, a device reboot is needed.

As for the data stored on the device, there is no way to recover it, as mentioned earlier.

“DoubleLocker serves as just another reason for mobile users to have a quality security solution installed, and to back up their data on a regular basis,” concludes Štefanko.


Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

E-Business

Elon Musk Seeks $134Bn from OpenAI, Microsoft for ‘Wrongful Gains’

Published

on

Kindly share this post

Elon Musk, billionaire Tesla owner, has asked a United States (US) federal court to award him up to $134 billion in damages from OpenAI and Microsoft, stating that the companies earned “wrongful gains” from his early support of the artificial intelligence startup.

Elon Musk Seeks $134Bn from OpenAI, Microsoft for ‘Wrongful Gains’

Elon Musk,

This is according to a court filing, reported by Reuters.

In filings ahead of a trial expected to start in April in Oakland, California, Musk stated that OpenAI benefited between $65.5 billion and $109.4 billion from his contributions when he helped co-found the organisation in 2015, and Microsoft gained between $13.3 billion and $25.1 billion through its involvement.

He has asked a United States (US) federal court to award him up to $134 billion in damages from OpenAI and Microsoft, stating that the companies earned “wrongful gains” from his early support of the artificial intelligence startup.

This is according to a court filing, reported by Reuters.

In filings ahead of a trial expected to start in April in Oakland, California, Musk stated that OpenAI benefited between $65.5 billion and $109.4 billion from his contributions when he helped co-found the organisation in 2015, and Microsoft gained between $13.3 billion and $25.1 billion through its involvement.

Musk’s legal team argues that his early financial and strategic contributions, including approximately $38 million in seed funding, the recruitment of key personnel, and assistance in connecting founders with contacts, laid the foundation for the later success of OpenAI and Microsoft’s commercial AI efforts.

“Without Elon Musk, there’d be no OpenAI. He provided the bulk of the seed funding, lent his reputation, and taught them all he knew about scaling a business. A pre-eminent expert quantified the value of that,” Musk’s lead trial lawyer Steven Molo told Reuters.

“Just as an early investor in a startup company may realise gains many orders of magnitude greater than the investor’s initial investment, the wrongful gains that OpenAI and Microsoft have earned—and which Mr Musk is now entitled to disgorge—are much larger than Mr Musk’s initial contributions,” the filing said.

Musk, who left OpenAI’s board in 2018 and now leads AI company xAI, alleges that OpenAI violated its founding non-profit mission when it restructured to include a for-profit arm tied to Microsoft’s investment and commercial strategy.

Meanwhile, OpenAI has labelled the lawsuit “baseless” and part of a “harassment campaign” by Musk, and Microsoft’s legal team has said there is no evidence the company “aided and abetted” OpenAI in any wrongdoing.

Both companies have asked the judge to limit what Musk’s expert witness may present at trial, arguing that the damages calculations are unreliable and could mislead a jury.

According to Reuters, Musk’s filing says he may pursue punitive damages and other penalties, including a possible injunction, if the jury finds the companies liable, though it did not specify what form any injunction would take.


Kindly share this post
Continue Reading

E-Business

Nigeria Targeted with 4,622 Cyber-attacks Per Week in December 2025

Published

on

Kindly share this post

In December 2025, organisations globally faced sustained cyber pressure, as the average number of cyber-attacks per organisation per week reached 2 027, a 1% increase from the previous month and a 9% increase from December 2024.

This is according to December 2025 Global Cyber Attack Statistics by Check Point Research, the threat intelligence arm of Check Point Software Technologies.

According to the statistics, Latin America was the hardest hit, with companies experiencing an average of 3 065 cyber-attacks per week, a 26% year-over-year increase.

In contrast, Africa saw a decline in attacks, with Nigeria (4 622 attacks per week) and Angola (4 002 attacks per week) being the most targeted countries on the continent.

The report’s findings highlight the evolving cyber threat landscape, with ransomware and GenAI-driven data risks posing significant challenges to companies worldwide.

Ransomware attacks jumped 60% year over year, with 945 publicly reported incidents in December. Qilin was the most active ransomware operator, responsible for 18% of publicly disclosed attacks.

“Ransomware continues to scale through industrialised operations, while unmanaged GenAI usage is creating widespread data exposure at enterprise level,” said Omer Dembinsky, data research manager at Check Point Research.

The report noted the education sector was the most targeted industry globally, with 4 349 cyber attacks per week; followed by government (2 666 attacks per week); and associations and non-profits (2 509 attacks per week).

The widespread adoption of GenAI tools has introduced new cyber security risks, with one in 27 GenAI prompts posing a high risk of sensitive data leakage.

Experts warn that companies must prioritise prevention-first security, real-time AI threat intelligence and strong governance over AI tools to mitigate these risks.

Hendrik de Bruin, head of security consulting at Check Point Software, added: “Strengthening ransomware resilience, deploying AI-powered prevention and enforcing clear GenAI governance will be critical to reducing cyber risk in the year ahead.”


Kindly share this post
Continue Reading

E-Business

Half of Global Companies Build SOCs to Enhance Cybersecurity, with a Focus on Human Expertise

Published

on

Kindly share this post

Among the primary reasons for establishing a Security Operations Center (SOC) are strengthening cybersecurity posture, enabling faster detection and response and gaining a competitive edge.

Interestingly, despite the increasing demand for automated cybersecurity solutions, businesses rely on skilled security professionals to make key decisions, as human expertise remains essential for effective security management.

A Security Operations Center (SOC) is a dedicated organisational unit responsible for continuous monitoring and safeguarding of a company’s IT infrastructure. Its core mission is to proactively detect, analyse and respond to cybersecurity threats.

To identify the main drivers, strategic priorities, and potential challenges in SOC planning and implementation, Kaspersky has conducted a comprehensive global study involving senior IT security specialists, managers and directors from companies with 500 or more employees.

All participants operate without a SOC but have plans to establish one in the near future. The study spans 16 countries across APAC, META, LATAM, Europe, and Russia, providing valuable insights into the emerging trends and best practices in SOC development worldwide.

The findings of the research reveal that 50% of companies intend to establish SOCs to strengthen their cybersecurity posture, and 45% are motivated by the need to address increasingly sophisticated and dangerous threats.

Other drivers include budget optimisation, the necessity for faster detection and response, and the expansion of software, endpoints and user devices – factors that demand more comprehensive and layered security measures.

These are cited by 41% of organisations. Additionally, 40% seek better protection of confidential information, 39% aim to meet regulatory requirements and one-third (33%) expect SOC capabilities to provide a competitive edge. Larger enterprises tend to cite each of these reasons more often, reflecting the broader operational and regulatory pressures they experience.

Continuous monitoring becomes the leading SOC requirement

Among the key functions organisations plan to delegate, 24/7 security monitoring leads at 54%. This around-the-clock vigilance enables early detection of anomalies, prevents escalation and sustains cyber resilience in real-time. This demand highlights a strategic requirement for proactive risk management, as organisations aim to defend against persistent threats that can strike at any moment.

Companies intending to fully outsource SOC operations show a stronger interest in applying “lessons learned” methodologies, whereas those developing internal SOCs focus more on access management to maintain tighter control.

Human expertise drives SOC technology choices

While SOCs use advanced technology, the choices made by organisations show that human analysts are very important. Among the solutions that organisations plan to include in SOC are – Threat Intelligence Platforms (48%), Endpoint Detection and Response (42%) and Security Information and Event Management systems (40%) – sophisticated solutions that automate data collection and reduce operational load, however, they depend heavily on skilled security professionals who provide critical context, interpret complex findings and make final decisions when guiding appropriate responses.

Other solutions chosen include Extended Detection and Response (38%), Network Detection and Response (37%) and Managed Detection and Response (33%). Large enterprises tend to adopt more technologies (5.5 per SOC on average), while smaller ones integrate fewer (3.8).

“To successfully build a SOC, companies must prioritise not only the right mix of technology but also the careful planning of processes, clear goal-setting and effective resource distribution.

“Well-defined workflows and continuous improvement are essential to ensure that human analysts can focus on critical tasks, making the SOC a proactive and adaptable component of their cybersecurity strategy,” comments Roman Nazarov, Head of SOC Consulting at Kaspersky.

 


Kindly share this post
Continue Reading

Trending