There's a new twist in the ransomware game. Some (presumably) Russian cyber criminals have found a new way to deliver 'the goods' named "Fantom". They come disguised as a “Windows Update”, complete with a fake Windows Update screen pretending to be performing a “critical update”. This is the 'a.exe' file included with the encrypter, called 'WindowsUpdate.exe'. It even has a 'percent installed' meter and a warning not to turn off the computer during the update.

Needless to say, all it's doing is encrypting your files and you'll have to pay to 'decrypt' them.

The encryption occurs during the 'Configuring Update' screen, generating a random AES-128 key which is uploaded to the criminals' Command and Control Server.

Finally it opens an html file (in pretty poor English) informing you that you are screwed, and offers to decrypt 2 small files as proof they are on the level. They also mention that you have one week to pay or your key will be destroyed.

So… back up your data, and let the genuine Windows Update do its thing. MS will NEVER put updates out on the net to download.

Source:

https://malwaretips.com/threads/fantom-ransomware-encrypts-your-files-while-pretending-to-be-windows-update.62764/

http://www.neowin.net/news/fantom-ransomware-pretends-to-be-windows-update-while-it-encrypts-your-files