It just replaces the original Bitcoin wallet address with the one owned by the proxy operators. That’s where the scammers are being scammed.Īccording to the notice posted on LockerR, the onion.top Tor proxy has started redirecting Bitcoin payments from the ransomware makers to a different address.

Therefore, scammers direct them to Tor proxies that can load a Tor service in a standard browser. The problem is that most Ransomware victims don’t know how to access Tor. This is where many scammers operate due to the relative safety compared with the open internet. This service runs on the Tor network, a spiderweb of encrypted nodes across the world that can route traffic anonymously and host hidden services. The new attack on scammers was spotted by security firm Proofpoint, which noticed a warning posted to a ransomware payment portal called LockerR. Still, it won’t do the original ransomware victims any good. Ransomware payments are being diverted via a man-in-the-middle attack, which is some sort of perverse justice. Now, it’s the scammers who are the victims of a clever ruse by even more devious online criminals. Victims are powerless to thwart the attack, so many just pay up. These programs lock up your files with encryption and threaten to delete them unless you pay a cryptocurrency ransom. Ransomware is some of the most devious and frustrating malware floating around the internet.

Tor proxy service