New Android Ransomware

Zscaler ThreatLabZ analyzed a stealthy Android ransomware variant that automates repackaging of legitimate apps (including a popular Russian app) to inject an obfuscated payload which remains dormant for four hours, then prompts for device-admin rights, locks the screen with a ransom message, notifies a C2, and resists AV detection via encryption, reflection, and delayed execution; researchers found no data exfiltration or unlock capability, published SHA1 indicators, and recommended removal and defensive measures.