PC Repair Requested, but Technicians Installed Ransomware and Extorted Hundreds of Millions

Police Arrest 9 Employees of Nationwide Computer Repair Company
Installed Self-Made Ransomware and Inflated Recovery Fees
Also Deceived Customers by Claiming Simple Malfunctions Were Ransomware Infections to Extort Money

[Asia Economy Reporter Song Seung-yoon] Repair technicians who implanted self-made ransomware on customers' PCs or deceived them into believing their PCs were infected with ransomware, thereby embezzling over 300 million won, have been arrested by the police.

The Cyber Investigation Division of the Seoul Metropolitan Police Agency announced on the 16th that they had arrested nine computer repair technicians nationwide on charges including violation of the Information and Communications Network Act and fraud. Among them, two with serious charges were detained.

According to the police, the suspects are accused of secretly implanting self-made ransomware on PCs brought in for repair due to performance degradation or other issues, or inflating recovery fees while negotiating with hackers on behalf of companies actually attacked by ransomware, embezzling approximately 362 million won from 40 victims.

Mr. A and others reportedly created ransomware at the end of December last year that encrypts documents and image files with the '.enc' extension, and conspired to infect customers' computers using remote intrusion malware. From January to February this year, they installed this malware on computers of 20 companies that requested on-site repairs, executed the self-made ransomware, and encrypted the files on the computers. Later, they collected 32.6 million won from four companies that requested recovery again, claiming the incident was caused by hackers.

They also extorted 330 million won from 21 companies that had actually been attacked by ransomware and requested recovery, using negotiations with hackers as a pretext. Additionally, there were cases where they deceived customers whose PCs showed common malfunction symptoms such as poor contact or boot failure into believing they were infected with ransomware and extorted money.

The police began investigating after receiving a report in December last year from a company that had been attacked by hackers' ransomware. While tracking the hackers, they uncovered the suspects' crimes and conducted an investigation. The police also booked the repair companies that shared profits with them under joint liability provisions and seized all ransomware and malware used in the crimes.

A police official stated, "Paying ransomware ransom can make you a continuous target of hackers, so you should report to the police immediately upon attack," and added, "The police will relentlessly pursue and arrest those involved in ransomware-related crimes that undermine social trust in information and communication networks."