The Nigerian Communications Commission (NCC) has alerted members of the public about how a cybercrime group has perfected a New Year scheme to deliver ransomware to targeted organisational networks.

The new ransomware uncovered by security experts has been categorised by the Nigerian Computer Emergency Response Team’s (ngCERT) advisory as high-risk and critical.

NCC explained in a statement that the ngCERT advisory, in its receb5 release, said the criminal group had been mailing out USB thumb drives to many organisations in the hope that recipients will plug them into their PCs and install the ransomware on their networks.

While businesses are being targeted, criminals could soon begin sending infected USB drives to individuals. Describing how the cybercrime group runs the ransomware, the ngCERT advisory said the USB drives contain so-called ‘BadUSB’ attacks.

The BadUSB exploits the USB standards versatility and allows an attacker to reprogram a USB drive to emulate a keyboard to create keystrokes and commands on a computer. It then installs malware prior to the operating system booting, or spoofs a network card to redirect traffic.

Numerous attack tools are also installed in the process that allows for exploitation of personal computers (PCs), lateral movement across a network, and installation of additional malware.