There's a bad news for hardcore passionate Gamers around the world. A researcher at Security firm Emisoft have found a malware named Teslacrypt malware which is a kind of Ransomware. Ransomware is a category of malware spread online by cybercriminals in order to get a ransom money from the user in lieu of decryption key for the files, which are in possession of the criminals . This new breed of ransomware dubbed as Teslacrypt malware is found hijacking the user files especially related to Gaming. It is said to resemble with Cryptolocker and also the ransomware calls itself "Cryptolocker-V3", but its working mechanism is distinct, and hence may be the previous workarounds for decryption like decryptolocker are found to be getting failed! Cryptolocker generally encrypts the user files on system and demands a ransom for providing decryption key in order to get back the files.

Teslacrypt malware is specially designed to encrypt game save content and DLC (extra downloadable content), along with images and text files on user system.

Affected Games!

50 file extensions connected to video games, in addition to images, documents, iTunes files and more are found to be affected. The game titles in the crosshairs include Call of Duty, Minecraft, Half Life 2, Elder Scrolls, Skyrim, Assassins Creed, World of Warcraft, Day Z and League of Legends. Several other Valve and Bethesda games are also affected. Another target is Steam, a popular game client.

Although, users found discussing about this issue on Bleeping Computer, were not really worried as they said its mostly going to affect saved games etc. of very few games because most of the games are online and their data is never stored locally. So a user can simply reinstall the game and can enjoy it again.

Another interested thing which was to be noted was, the cybercriminals botched notification date (29/02/15) for the destruction of decryption key and users found mocking about this on the forum.

Technical Details

The ransomware will change your Desktop wallpaper to a ransom note and create another ransom note called HELP_TO_DECRYPT_YOUR_FILES.txt on your desktop. A lock screen will then appear that explains your data was encrypted and that you have 3 days to make payment. This lock screen contains buttons that allow you to check whether a payment has been accepted, the ability to enter your decryption keys, and a link to a TOR payment site where you can perform a free file decryption as a test.

Mitigation

Since the Decryptolocker are not working for this new variant of Cryptolocker, prevention is the best defense. Users and specially gamers around the world are advised not to click on any kind of suspicious links or download any suspicious files, which may lead to downloading of this malware to their computer and hence affect it badly.