E-Business
ESET Researchers Spot DoubleLocker ‘Innovative’ Android Ransomware
By peter oluka
ESET researchers have spotted the first-ever ransomware misusing Android accessibility services. On top of encrypting data, it also locks the device.
Detected by ESET products as Android/DoubleLocker.A, the ransomware is based on the foundations of a particular banking Trojan, known for misusing accessibility services of the Android operating system.
However, DoubleLocker doesn’t have the functions related to harvesting users’ banking credentials and wiping out their accounts. Instead, it has received two powerful tools for extorting money from its victims.
DoubleLocker can change the device’s PIN, preventing victims from accessing their devices, and also encrypts the data it finds in them – a combination that has not been seen previously in the Android ecosystem.
“Given its banking malware roots, DoubleLocker may well be turned into what could be called ransom-bankers. Two-stage malware that first tries to wipe your bank or PayPal account and subsequently locks your device and data to request a ransom… Speculation aside, we spotted a test version of such a ransom-banker in the wild as long ago as May, 2017,” comments Lukáš Štefanko, the ESET malware researcher who discovered DoubleLocker.
Distribution
DoubleLocker spreads in the very same way as its banking parent does. It is distributed mostly as a fake Adobe Flash Player through compromised websites.
Once launched, the app requests activation of the malware’s accessibility service, named “Google Play Service”. After the malware obtains the accessibility permissions, it uses them to activate device administrator rights and set itself as the default Home application, in both cases without the user’s consent.
“Setting itself as a default home app – a launcher – is a trick that improves the malware’s persistence. Whenever the user clicks on the home button, the ransomware gets activated and the device gets locked again. Thanks to using the accessibility service, the user doesn’t know that they launch malware by hitting Home,” explains Štefanko.
Locking Both Device And Data
DoubleLocker, once executed on the device, creates two reasons for the victims to pay.
First, it changes the device’s PIN, effectively blocking the victim from using it. The new PIN is set to a random value which the attackes neither store nor send anywhere, so it’s impossible for the user or a security expert to recover it. After the ransom is paid, the attacker can remotely reset the PIN and unlock the device.
Second, DoubleLocker encrypts all files from the device’s primary storage directory. It utilizes the AES encryption algorithm, appending the extension “.cryeye”. “The encryption is implemented properly, which means that, unfortunately, there is no way to recover the files without receiving the encryption key from the attackers,” says Štefanko.
The ransom has been set to 0.0130 BTC (approximately USD 54 at time of writing) and the message highlights that it must be paid within 24 hours. However, if the ransom is not paid, the data will remain encrypted and will not be deleted.
How To Get Rid Of It?
In the ransom note, the user is warned against removing or otherwise blocking DoubleLocker: “Without [the software], you will never be able to get your original files back”.
To prevent unwanted removal of the “software”, the crooks even recommend disabling the user’s antivirus software.
“Such advice is irrelevant: all those with a quality security solution installed on their devices are safe from DoubleLocker,” explains Štefanko.
The only viable option to clean the device of the DoubleLocker ransomware is via a factory reset.
For rooted devices, however, there is a method to get past the PIN lock without a factory reset. For the method to work, the device needed to be in the debugging mode before the ransomware got activated.
If this condition is met, then the user can connect to the device by ADB and remove the system file where the PIN is stored by Android. This operation unlocks the screen so that the user can access their device. Then, working in safe mode, the user can deactivate device administrator rights for the malware and uninstall it. In some cases, a device reboot is needed.
As for the data stored on the device, there is no way to recover it, as mentioned earlier.
“DoubleLocker serves as just another reason for mobile users to have a quality security solution installed, and to back up their data on a regular basis,” concludes Štefanko.
National Identity Management Commission (NIMC) has kicked off a three-day training program for 388 personnel aimed at enhancing the National Identification Number (NIN) enrolment process across the country.
The training, tagged “Refresher Training of Trainers on NIN Integration to the National Social Register: Technical and hands-on devices and field operations and procedures”, is in collaboration with the National Social Safety-Net Coordinating Office.
The training is also to equip personnel with the necessary skills to efficiently handle the complexities of enrolment processes
In her address at the event held in Port Harcourt on Monday, Abisoye Coker-Odusote, director-general and chief executive officer, NIMC, noted that the initiative aligns with the commission’s overarching goal of achieving secured and great success for the Renewed Hope social initiatives.
Represented by Adedapo Adedoyin, her technical advisor on ICT, the NIMC DG said the event is a pivotal initiative that marks a significant step forward in our mission to enhance and modernize the National Identification Number enrolment process across Nigeria.
She stated, “Today, I am pleased to announce the launch of a comprehensive training program aimed at refreshing the technical and operational skills of the National Social Safety-Net Coordinating Office State Operations Coordinating Unit and NIMC staff.
“This initiative focuses on practical and field-based exercises, ensuring that our teams are well-equipped to handle the complexities of enrolment processes with precision and efficiency.
“This initiative aligns with our overarching goal of achieving secured and great success for the Renewed Hope social initiatives. Through verified digital identification, we aim to improve the lives of Nigerians by providing them with access to essential services and opportunities that require a reliable and secure identity verification system”.
Coker-Odusote explained that the training program will be conducted in two batches, encompassing four states: Kwara, Nasarawa, Kano, and Rivers. A total of 388 attendees will participate in this initiative, including 225 NASSCO State Operations Coordinating Unit representatives, 35 NIMC facilitators, and 128 State support staff.
She added, “The sessions are meticulously designed to foster knowledge sharing and hands-on experience with NIMC’s enrolment device and software, ensuring that our personnel are adept at using these tools to their full potential.
“By empowering our teams with enhanced skills and practical experience, we are setting the stage for more efficient and accurate NIN enrolment processes across the nation”.
Coker-Odusote further said the training program “is a crucial step toward achieving the World Bank’s Identification for Development Initiative target of enrolling 180 million Nigerians with secure digital IDs.
“By bolstering our technical and operational capabilities, we are ensuring that NIMC is well-positioned to meet and exceed this target, thereby contributing to the global vision of inclusive and accessible digital identification for all”.
The NIMC boss8 called for collaboration between all stakeholders saying, “As we embark on this journey, I urge all participants to embrace this opportunity for growth and development.
“Together, we can build a robust and efficient National Identification System that will serve as the cornerstone for Nigeria’s social and economic progress.”
Kaspersky experts have uncovered a new phishing scam targeting businesses that promote their pages on Facebook. Scammers send emails allegedly on behalf of Meta for Business – Facebook’s platform for businesses – claiming the recipient’s page contains prohibited content.
The email suggests users provide explanations in order for their account and page to be unblocked. The goal of the attackers is likely to get access to users’ business accounts.
Kaspersky’s anonymised data shows that such emails started reaching users on 14 December 2024, with complaints coming from organisations all over the world, including the Middle East, Turkiye and Africa.
By examining the “From” field in the email it can be seen that the domain does not belong to Facebook. According to Kaspersky data the emails that this campaign used were sent from different domains.
The link in the email redirects users to Facebook Messenger. On Messenger, the account posing as Facebook’s support team appears legitimate, creating a false sense of trust.
There is an indication that this is a fan page, but it is easy to miss in a situation of high stress after being accused of spreading illegitimate content.
This scheme stands out for its sophistication. Unlike earlier scams that accused users of copyright violations and directed them to respond via email, this approach simulates internal communication on the Facebook platform itself.
“In 2025, we anticipate a rise in attacks leveraging social engineering and user trust in major platforms. Scams like this are becoming more sophisticated as attackers strive to mimic official services closely.
“Users must remain vigilant, verify the authenticity of messages, and avoid clicking on suspicious links. We strongly advise users not to engage with suspicious accounts and to activate additional security measures, such as two-factor authentication.
“If you receive such an email, report the incident to Facebook’s support team and update your passwords immediately if any information has been compromised,” comments Andrey Kovtun, Email Threats Protection Group Manager at Kaspersky.
Lagos State government and the Nigerian Postal Service (NIPOST) are joining forces to revolutionise e-commerce logistics in Nigeria’s economic capital.
The collaboration aims to enhance last-mile delivery and optimise connectivity within Lagos and beyond.
During a courtesy visit to governor Babajide Sanwo-Olu, Ms. Tola Odeyemi, postmaster-general and CEO of NIPOST, highlighted the strategic importance of Lagos in driving innovation in the e-commerce sector.
“As the e-commerce landscape continues to evolve, Lagos leads the charge in this growth. Through enhanced postal and logistics services, we seek to empower small businesses and individuals engaging in this expanding sector,” Odeyemi said.
She underscored her commitment to fostering partnerships that would align NIPOST with the demands of a modern economy, identifying Lagos as a pivotal partner.
Lagos is central to achieving our vision of efficient and future-ready postal services, she added.
Odeyemi applauded Lagos state for its vibrant programmes that drew global attention during the December festivities, stating that such initiatives could drive further economic growth and diaspora engagement.
She pledged enhanced postal and logistics support to drive e-commerce growth and empower small businesses in Nigeria., highlighting NIPOST’s readiness to collaborate with Lagos State to enhance last-mile delivery, foster innovation, and improve public service delivery.
Lagos, as Nigeria’s economic hub, is a critical partner in our vision to make NIPOST’s services more efficient and relevant in today’s world, Odeyemi stated.
She commended Lagos State for its strides in infrastructure and governance, underscoring the importance of strategic partnerships to optimize connectivity within Lagos and nationwide.
Governor Sanwo-Olu challenged NIPOST to rethink its approach and embrace technology as a transformative tool for business facilitation.
“For NIPOST to remain relevant, you must challenge the status quo, revamp your services, and adopt innovative strategies that address today’s needs and anticipate future demands,” the governor advised.
He also pledged Lagos state’s support in upgrading NIPOST’s infrastructure to improve service delivery and create an enabling environment for seamless e-commerce operations.
FG Plans Aircraft Manufacturing in Nigeria
FCCPC Insists Telcos’s Tariff Hike must Translate to Improved Services
Sub-Saharan Africa Lost $1.56Bn to Internet Shutdown in 2024 – Report
USSD Dispute: FG May Blacklist 18 Banks Allegedly Owing Telcos N250Bn
NIMC Trains 388 Personnel to Boost NIN Enrolment
MTN Nigeria Renews Spectrum Lease Agreement with NTEL
NERC Discloses $5.7 Million Debt Owed by International Customers for Q3 2024 Electricity Supply
CBN, SEC Approve FCMB Group’s N147bn Rights Offer
A beginner’s guide to Temu: Your ultimate shopping companion
Corporate Blackmail, My Story as a Case Study, by Leo Stan Ekeh, Chairman Zinox Group
