Ransomware group forces victims to 'pick any 5 poor children' and buy them KFC

face-on of criminal in ski mask surrounded by lines of code implying hacking, with kfc bucket, faceapp smile, and dominos deliveryperson amateurishly edited in
(Image credit: Caroline Purser/Getty)

As reported by the security outfit CloudSEK, a new ransomware group called GoodWill forces its victims to give to the poor in order to regain access to their files. 

GoodWill seems to originate out of Mumbai, India, and like other ransomware will encrypt important files on an infected device, requiring an encryption key provided by the hackers to regain access. Unlike typical ransomware attacks, which ask for money in the exchange, Goodwill charges victims with three peculiar acts of charity. It is unclear from the CloudSEK report how many people have been targeted by the group, or whether anyone has actually gone through with the process.

The first task is to "provide new clothes/blankets to needy people of road side [sic] and make a video of this event," with proof posted to Facebook, Instagram, and WhatsApp. Next, GoodWill targets have to "in the evening, pick any 5 poor children (under 13 years) of your neighborhood and take them to Dominos / Pizza Hut or KFC, then allow them to order the food they love to eat and try to make them feel happy." The hackers also want you to film and take pictures of the kids for social media, very cool. The final GoodWill charge is to pay for the medical bills of someone who can't afford to, and, of course, post it to Facebook et al.

(Image credit: CloudSEK)

It's all a bit… corny? Like something out of a chain email your grandma might send, except the security threat is very real. The element of posting proof to social media, coupled with the incredible profile frame provided to anyone who's overcome all the hurdles, indicates to me that this is much more about humiliation than actually helping anyone.

GoodWill's scheme reminds me of how the guy from Death Note thought he was going to change the world by orchestrating extralegal executions of small-time criminals. Light Yagami, my man, if you want to move the needle you have to think bigger. I'm sure these GoodWill guys can do some digging and figure out why so many people have enormous medical bills…

But I would never encourage criminal activity of any kind. Alongside the general chain email vibe I'm really caught up on the whole "take five needy kids out to eat" thing. What parent in their right mind would allow that? "Don't worry, I'm not trying to abduct your kid—hackers just stole all the data for my HVAC business and this is how I get it back. I also have to film your child eating. Normal stuff." 

Karmically, maybe all this cynicism is just me begging to be GoodWill's next victim. Those kooky hackers in Mumbai are about to teach me a valuable lesson about giving, humility, and filming people (including children) experiencing life-changing Kentucky Fried Chicken.

Associate Editor

Ted has been thinking about PC games and bothering anyone who would listen with his thoughts on them ever since he booted up his sister's copy of Neverwinter Nights on the family computer. He is obsessed with all things CRPG and CRPG-adjacent, but has also covered esports, modding, and rare game collecting. When he's not playing or writing about games, you can find Ted lifting weights on his back porch.

Read more
Three Magikarp Pokémon
The FBI used self-destruct on malware infecting over 4,000 US computers, it's super effective
An FBI wanted poster for alleged hacker Zhou Shuai.
US Justice Dept announces $10 million bounty on at-large 'hacker-for-hire' cabal it says targeted China critics, religious missionaries, and the Treasury
An image of a fake Bitcoin with a laptop in the background displaying financial data
North Korean hackers are said to have stolen $1,300,000,000 in crypto in 2024, an estimated 61% of the total funds swiped this year
 In this photo illustration a novelty Bitcoin token is photographed on a US Dollar bank note, on January 4, 2025 in Bath, England. The Cryptocurrency market has recently received a significant boost by the election of Donald Trump with hopes of the start of a policy framework that could see Bitcoin as a strategic asset
Man charged with $65,000,000 worth of cryptocurrency heists was reportedly discovered through chatting on Discord with a company they allegedly stole from
Two pictures of the WinRAR messenger bag
With great self-awareness WinRAR releases official $150 merch: 'What better way to support the software you’ve NEVER paid for than by buying a WinRAR bag?'
Steam logo
A web3 free-to-play survival game found to be a front for installing malware on your PC has finally been removed from Steam
Latest in Gaming Industry
Discord Social SDK
Your Discord friends list may soon appear directly in the games you play
Aloy - Horizon
'I feel worried about this art form:' Unsurprisingly, the real Aloy from Horizon isn't a fan of AI Aloy
Geralt, two swords on his back, in the wilderness
2011 was an amazing comeback year for PC gaming
Assassin's Creed meets PUBG
Ubisoft is reportedly talking to Tencent about creating a new business entity to manage Assassin's Creed and other big games
Possibility Space concept art.
Possibility Space owners sue NetEase for $900 million over allegations it spread 'false and defamatory rumors' of fraud at the studio that ultimately forced it to close
Valve soldier man on a pc.
2024 was Steam's 'best year ever' of users buying newly released games—but I wouldn't celebrate the end of the forever game era just yet
Latest in News
Metro Exodus
'I want to raise this glass to our fans, to our community': 4A Games celebrates Metro 2033's 15th anniversary and hints at next Metro game
Assassin's Creed Shadows promo image
Ubisoft reportedly has an anti-harassment plan in place for Assassin's Creed Shadows developers
Avowed Kai holding out his hand toward camera while explaining something to the player.
Avowed's new patch just gave you 6 more talent points to muck around with, along with a heap of fixes and improvements
In-game recreation of iconic Indiana Jones stealing the idol in Indiana Jones and the Great Circle
Silent Hill 2 remake and Indiana Jones are at historically low prices this Steam Spring Sale—so long as you don't buy them directly from Steam
MSI RTX 5070 Ti Gaming Trio OC Plus graphics card under a red light
This MSI Afterburner file unlocks 36 Gbps RTX 50-series memory overclocks for, y'know, the few people that actually own a card
A Steam Deck with SteamOS running in desktop mode.
A new and improved desktop experience just landed on Steam Deck and SteamOS is readying 'support for non-Steam Deck handhelds'