This family of Trojans blocks the user’s computer and requests a ransom for restoring its functionality.
The program adds itself to the list of programs launched automatically after the operating system loads, limits access to the desktop, and hides the windows of the Windows Task Manager and system controls, such as the taskbar and Start menu.
Geographical distribution of attacks by the Trojan-Ransom.Win32.Foreign family
Geographical distribution of detections during the period from 20 November 2014 to 20 November 2015
Top 10 countries with most attacked users (% of total attacks)
* Percentage of all unique Kaspersky users attacked by this malware