And Now a Ransomware Tool That Charges Based On Where You Live

Malware is designed to charge more for victims in countries with a higher cost of living, Recorded Future says.

The creators of Fatboy, a new and somewhat politically incorrectly named ransomware tool that surfaced recently on a Russian crimeware forum, appear to have adopted an interesting economic approach in designing the malware.
It is the first known online extortion product that is designed to automatically change ransom amounts based on the victims location. Instead of hitting up all victims with a flat ransom amount, Fatboy is programmed to charge more to decrypt data for victims in countries with a higher cost of living, threat intelligence firm Recorded Future said in a
blog
this week.
The payment scheme is based on the so-called
Big Mac Index
, an interactive currency comparison tool that
The Economist
created in 1986 to assess whether international currencies are at their correct relative levels or are undervalued. It basically compares the average price of a Big Mac in the U.S. against prices for the same product in various other countries to determine currency trends.
The tool, which
The Economist
has said was originally designed as a lighthearted attempt to gauge currency misalignment, has become a global standard for measuring international purchasing power parity.
Fatboy, according to Recorded Future, uses the same index to determine which of its victims get to pay more and which of them get to pay less—at least in relative terms.
The malware is being offered under a ransomware-as-a-service (RaaS) model via a Russian forum that is used by cyber criminals.
Fatboy and other RaaS products mirror many strategies of the legitimate business world, particularly the necessity to collaborate and tailor products to match the needs of customers, says Diana Granger, junior technical threat analyst at Recorded Future.
Fatboy first surfaced on the Russian cybercrime forum March. Since then the authors of the tool,appear to have made a somewhat modest $5,321 by way of ransomware payments.
An advertiser using the handle polnowz has been attempting to get buyers for the tool. Unlike other malware tools that are available under a RaaS model, anyone that signs up for Fatboy will work directly via Jabber with the author of the product instead of a third-party distributor. The additional transparency appears designed to get would-be cyber extortionists to sign up for the service says, Granger says.
As of this week, the efforts appear to have borne little fruit. Fatboy has not yet received any member endorsements or feedback from the forum.
Granger says Recorded Future has no data on usage of Fatboy, nor how much exactly its ransom amounts vary by country. From the standpoint of its core functionality, Fatboy is similar to the many other data encryption ransomware tools in the wild. The automatic rate adjustment and direct partnership is what differentiate it, she says.
Related stories
7 Steps to Fight Ransomware
Cerber Ransomware Now Evades Machine Learning
Threats Converge: IoT Meets Ransomware

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
And Now a Ransomware Tool That Charges Based On Where You Live