New Crypto-Stealing Ransomware Targets Fortnite Players

A new ransomware masquerades as a Fortnite cheat and asks victims to pay up in crypto.

AccessTimeIconAug 26, 2019 at 7:00 p.m. UTC
Updated Dec 11, 2022 at 7:48 p.m. UTC
A new piece of  ransomware called Syrk will encrypt files on your hard drive while deleting entire folders if the ransom is not paid. The malware is based on the open source  Hidden-Cry program, an encryptor that appeared online last December and has been the basis for many bits of malware over the past year.

Image via Cyren

Home to some 250 million players, Fortnite users are a prime target for this kind of malware.

“Combining game malware with ransomware was inevitable,” said Chris Morales, head of security analytics at Vectra. “Social engineering through online video games has been going on for some time. It is a large audience to target and an industry that is known to look for shortcuts. Malware posing as a hack tool is novel as it will not be validated by any app store and bypasses the normal security controls. This makes encrypting files using a game hack highly opportunistic and easy to execute.”

Syrk targets Fortnite users by masquerading as a cheating app for the game. The Syrk malware appears as "SydneyFortniteHacks.exe" and when it is run the app begins encrypting files on the user's hard drive and USB drives. If a ransom isn't paid in crypto the app starts deleting one important folder after another, culminating in your Documents folder

“The next step is it will set a timed procedure to try and delete the encrypted files in the directories listed below, deleting the files every two hours in the following order: %userprofile%\Pictures; %userprofile%\Desktop; and %userprofile%\Documents,” the researchers wrote.

Luckily the malware is based on a known attack vector and the software is easy to circumvent. Victims can easily unlock their computers by looking for a few text files on their drives. These files contain the passwords use to shut down the ransomware before it can delete your files, a nice feature that should stop many from having to shell out crypto for a clean computer.

Given the ease with which users can disable the malware, it's not clear how many victims paid the crypto ransom the creators required.

Image via Shutterstock.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

Learn more about Consensus 2024, CoinDesk’s longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.