Free Followers is an Android ransomware derived from the XRansom builder - A FOSS ransomware builder located on GitHub by a threat actor named XPHANTOM. Someone pulled this repository and created their version of the XRansom ransomware using the 'Free Followers' app name. The ransom note utilized the SYSTEM_ALERT_WINDOW permission to invoke a modal on the victim's device that demanded ₹1000, which was about $12.80 at the compilation time. Not only is this a small sum, but to close the window, all one has to do is kill the application process. The password to the ransom note is hardcoded into the source code - "Abdullah@." However, after the password is entered, the program re-invokes the modal, meaning that the ransom note alert window is in an infinite loop. Finally, based on the ransom note phone number's country calling code of +92 and the fact that the ransom is in rupees, we assume the threat actor (who claims to be from Anonymous Group) is from Pakistan.
