Ransomware Spreads Outside Russia
Ransomware infections were initially limited to Russia, but its popularity and profitable business model soon found its way to other countries across Europe. By March 2012, Trend Micro observed a continuous spread of ransomware infections across Europe and North America. Similar to TROJ_RANSOM.BOV, this new wave of ransomware displayed a notification page supposedly from the victim’s local police agency instead of the typical ransom note (see Reveton, Police Ransomware below).

During this period, different tactics were being used to spread ransomware. A case in 2012 involved a popular French confectionary shop’s website that was compromised to serve TROJ_RANSOM.BOV. This watering hole tactic resulted in widespread infections in France and Japan, where the shop also had a significant fan-base. Instead of the usual ransom note, TROJ_RANSOM.BOV displayed a fake notice from the French police agency Gendarmerie Nationale.

SOURCE  WWW.TRENDMICRO.COM