An adversary may encrypt files stored on the mobile device to prevent the user from accessing them, for example with the intent of only unlocking access to the files after a ransom is paid. Without escalated privileges, the adversary is generally limited to only encrypting files in external/shared storage locations. This technique has been demonstrated on Android. We are unaware of any demonstrated use on iOS.
| ID | Name | Description |
|---|---|---|
| S0422 | Anubis |
Anubis can use its ransomware module to encrypt device data and hold it for ransom.[1] |
| S0298 | Xbot |
Xbot can encrypt the victim's files in external storage (e.g., SD card) and then request a PayPal cash card as ransom.[2] |
| ID | Mitigation | Description |
|---|---|---|
| M1005 | Application Vetting |
A static analysis approach may be able to identify ransomware apps that encrypt user files on the device.[3] |