Malware dev lures child exploiters into honeytrap to extort them

BleepingComputer analyzed a recent campaign distributing a Windows malware named CryptVPN (PedoRansom) via a fake UsenetClub site: a downloaded ZIP contains a PowerShell shortcut that fetches and runs a UPX-packed executable saved as C:\Windows\Tasks.exe. Once executed the binary changes the desktop wallpaper to an extortion demand and drops README.TXT demanding $500 to a specified Bitcoin address (bc1q4zfspf0s2gfmuu8h5k0679sxgxjkd7aj5e6qyl); the unpacked binary contains a PDB path identifying it as PedoRansom and reported payments to the address are minimal, indicating limited impact so far.