(light music)
- Jigsaw.exe wants to play a game
and the odds don't seem to be in your favor.
Maybe you clicked a link you weren't supposed to.
Maybe you fell for a spam email.
How you got here doesn't matter now.
All that matters is how well you play.
There are multiple versions of the file
that you've fallen victim to,
but the most iconic one will greet you as such:
A window shoots up on-screen,
revealing the red, spiraling cheeks
of a character you might recognize.
Green text, letter by letter,
begins crawling over a black background.
It looks exactly like those mock hacking scenes in movies,
but you're about the learn just how thin the line
between fiction and reality can be.
The text begins laying out the rules:
"Your computer files have been encrypted.
Your photos, videos, documents, etc.
But, don't worry!
I have not deleted them yet.
You have 24 hours to pay 150 USD in Bitcoins
to get the decryption key."
At this point, it's natural for most people to feel anxious,
maybe even skeptical.
As the text crawls slowly,
you might even be inclined to try and terminate the process.
Bad move.
The Jigsaw virus counts these as infractions of its rules,
and it'll result in a thousand files
being purged as punishment.
In some versions, this rule is laid out clearly.
In others, it's something people had to learn the hard way.
When the text-crawl is finished,
there's something new in the window.
Red numbers over a black background,
like a bomb, illustrating the countdown has begun.
You might even be inclined to call the virus a bluff,
only to see that your other files,
indeed, are all locked away.
But instead of outright deleting all those files
at the 24-hour mark,
the virus wants you to feel the heat rising.
Of the some-61 variants I could find being recorded,
most versions of the virus
will begin wiping your data little by little
at the 60-minute mark
after not paying in the first 24 hours.
From then on, the pressure rises, as the text explains:
"Are you familiar with the concept of exponential growth?
Let me help you out."
It starts out slowly then increases rapidly.
During the first 24 hours,
you will only lose a few files.
The second day, a few hundred.
The third day, a few thousand, and so on.
Less than three days from now,
you realized everything will be lost.
You look down at the end of the lines
and lines of text explaining the rules.
You see the address they want you to pay to.
$150 USD, or 0.4 Bitcoin at the time,
was the most commonly recorded ransom that was demanded.
$150, you think, might not be that bad.
For many of us, we'd pay even more to recover
what may be lost.
Pictures, work files, family records, archives, etc.
$150, no, it could be way worse.
You look at that last line of text,
taunting you as the timer claims five minutes
have already passed.
Now, let's start and enjoy our little game together.
But before we dive into this mysterious virus,
a quick word from today's video sponsor: Babbel.
Learning a second language is something
that can be both very difficult and very rewarding.
I have personally always struggled
to learn a second language even with traditional classes,
but Babbel has made it easy.
Babbel is a language learning app
that simplifies the entire process
of learning a new language.
They focus on teaching the most important practical language
to be used in conversation
in short, 10-minute interactive lessons.
Because of this, Babbel has helped me
in getting to a point
where I was actually comfortable enough
to use the Spanish I learned through their app
while on a recent trip to ask for directions
to the nearest bus stop.
In addition, they actually make learning interesting
with podcasts, lessons, live classes, and even games
to help you on your journey.
With the new year finally here,
now is the perfect time to get started
and actually learn that new language
that you've always wanted.
If you'd like to give Babbel a try and get up to 60% off,
click the link down the description below
or scan the QR code on screen.
Thanks again to Babbel for sponsoring this video
and making this content possible.
Now, let's take a look at the strange virus.
Despite how dicey it all seems,
there was an easy way to win this game:
playing it by the malware's rules.
It goes against basically all professional advice,
but I was surprised to learn
that quote unquote, "playing,"
as in transferring the correct amount of money
to the account,
would give some people a decryption key.
Usually this wouldn't happen
as exchanging USD for Bitcoin
and sending it meant that the thieves
had already gotten what they wanted from you.
There was no refunds
and there would be little incentive
for them to stick to their own rules
when they've already won.
And yet, sometimes, they actually did.
Just like that,
the malware would release your data back to you
and delete itself from your computer.
Hopeful, but not enthusiastic,
that you may play again someday.
Of course, the odds of this happening got lower with time
as more versions of Jigsaw found their way into the wild.
Some would swap out the graphic
for other horror movie icons,
like Pennywise, the clown from "IT,"
while others would simply forgo an image altogether.
And these new versions didn't seem to follow
the rules of the game themselves:
not releasing the files back
once the ransom was actually paid.
But as a unique artifact in the history of ransomware,
the virus itself was most sinister
when drawing from its namesake.
That original character,
the mascot you see, is dubbed Billy the Puppet,
the mouthpiece of the Jigsaw killer in the "Saw" franchise.
Although the plot gets progressively more complex
with every new entry in the series,
from the initial seven movies to the more recent successors,
the main crux has always been simple:
Victims are placed in elaborate traps,
often needing to maim themselves to escape
before a timer reaches zero,
ending their life's for them.
Life or limb, the choice usually went.
Where most ransomware rely on a sense of urgency
to get their victims to pay up,
the Jigsaw virus seem to play into this even more.
As noted in the register,
it wants to tap into your distress even further.
It wants you to feel like you're playing a dangerous game,
all in the hopes that you might do anything to make it out.
Of course, in this case,
with your files rather than your life.
Infamous as it is, the virus emerged more than half decade
since the series had concluded its original run
as a Halloween box-office juggernaut.
Initial reports go back to 2016,
a record year for ransomware attacks.
As noted in an article by BackupAssist.com,
a notable aspect of the new malware on the scene
was the relatively small amount it was asking for.
The money that the virus demanded was far smaller
than any other crypto-ransomware and also varies wildly,
only asking for 20 to $200 USD worth of Bitcoins.
This leads many experts to believe that Jigsaw
is out to cause chaos, not earn cash.
Even if cash was secondary,
sites like 2-Spyware note that Jigsaw may have collected
around $450,000 from its victims
within only its first year of release.
And surprisingly enough, it has still been spotted
in the wild as recently as this year.
However, these reports are obviously difficult
to corroborate.
What we do know is that the virus was first listed for sale
on various ransomware boards around March of 2016,
that it only infects Windows operating systems,
and that its main mode of distribution
was and remains spam emails.
But perhaps the most important thing is now we know
that there are other ways of playing the game.
In an article by Charlie Osborne,
written in the first month the virus made waves
across the internet,
it was already evident that the virus
and its distribution was fatally flawed.
The use of C#/.NET in its source code
made reverse-engineering a solution pretty straight forward.
For every variant that sprung up,
a decryptor was perfected, sometimes even within weeks.
Word of advice for any new players:
Never, ever try paying
in the event you're the victim of ransomware.
At best, you're securing them an easy win,
and at worst, they might be bluffing
about your odds of making it out with something.
With decryptors now widely available,
the concern for many was that a more sophisticated version
of Jigsaw would make the rounds,
and for a while, one did.
This year alone has seen Jigsaw reach
the public imagination once again.
The FBI has alleged that Moises Luis Zagala Gonzalez,
a cardiologist in Venezuela,
has been moonlighting as a cybercriminal.
As alleged, the multi-tasking doctor treated patients,
created and named his cyber tool after death,
profited from a global ransomware ecosystem
in which he sold the tools
for conducting ransomware attacks,
trained the attackers about how to extort victims,
and then boasted about successful attacks,
including by malicious actors associated
with the government of Iran.
It is alleged that Gonzales created a second version
of the Jigsaw virus,
along with the longstanding Thanos virus,
named after the Marvel movie villain.
But Gonzales went further,
offering multiple ways for his customers
to pay for the virus,
either outright or by buying a license
until they saw a return on investment.
Gonzales is also alleged
to have offered excellent customer support,
which has earned him an excellent reputation
in the malware community,
and a spot on the FBI's wanted list.
As of today, he has still not been apprehended.
As I did my research on different kinds of malware,
I thought Jigsaw stood out as an important shift
in the landscape.
Ransomware attacks are nothing new.
Concerningly, they're on the rise,
stealing thousands more with each passing year.
Many of the most widely-reported incidents target hospitals
and vital institutions in the public sector.
Some, like Jigsaw.exe, are small in scale,
targeting persons and not populations,
but Jigsaw feels like a next step in the evolution
of the ransomware attack.
It's as creative as it is sinister,
relying on cultural signifiers to gain an upperhand
on the victim's best judgment.
It's not running quietly in the background.
It's using horror references
and the aesthetics of hacking in pop culture
to gain a psychological edge on its victims.
I'd love to hear if any of you have had any experiences
with malware that made you deeply uncomfortable,
or if you've actually dealt with Jigsaw.exe itself.
I'd love to hear your story.
And with that, I'd like to end off on one final question:
Do you want to play a game?
Thanks for watching till the end of the video.
If you enjoyed it, please consider subscribing
or dropping a like or comment on the video
as it really helps me out.
Thanks again and have a good night.
(light music)