Do you want to play a game? Ransomware asks for high score instead of money

At this point, Ars readers have heard countless tales of computer users being forced to pay significant sums to unlock files encrypted with malicious ransomware. So we were a bit surprised when word started to trickle out about a new bit of ransomware that doesn't ask for money. Instead, "Rensenware" forces players to get a high score in a difficult PC shoot-em-up to decrypt their files.

As Malware Hunter Team noted yesterday, users on systems infected with Rensenware are faced with the usual ransomware-style warning that "your precious data like documents, musics, pictures, and some kinda project files" have been "encrypted with highly strong encryption algorithm." The only way to break the encryption lock, according to the warning, is to "score 0.2 billion in LUNATIC level" on TH12 ~ Undefined Fantastic Object. That's easier said than done, as this gameplay video of the "bullet hell" style Japanese shooter shows.

Gameplay from TH12 ~ Undefined Fantastic Object on Lunatic difficulty. Players needed to get 200 million points to unlock the "Rensenware" malware.

As you may have guessed from the specifics here, the Rensenware bug was created more in the spirit of fun than maliciousness. After Rensenware was publicized on Twitter, its creator, who goes by Tvple Eraser on Twitter and often posts in Korean, released an apology for releasing what he admitted was "a kind of highly-fatal malware."

"I made it for joke, and just laughing with people who like Touhou Project Series," Tvple eraser writes. "So I distributed source code except compiled binary on the web. However, at the point of the distribution, the tragedy was beginning.

"A number of people blamed me. It's natural. because I made accident definitely wrong," he continues. "I'm not sure this apology is enough to you. If not, then I apologize again... It didn't meant to be evil. I hope you understand of it. [sic]"

The apology is embedded in a Rensenware "forcer" tool that Tvple Eraser has released to manipulate the game's memory directly, getting around the malware's encryption without the need to play the game (assuming you have a copy installed, that is). While the original Rensenware source code has been taken down from the creator's Github page, a new "cut" version has taken its place, showing off the original joke without any actually malicious forced encryption.

On the one hand, it seems Tvple Eraser never tried to force Rensenware on any remote computers, as most ransomware makers do for fun and/or profit. On the other hand, the Internet being what it is, the source code is doubtlessly still floating around out there, perhaps even in a modified form that can't be beaten by the new "forcer" tool. If a malicious user does end up using the Rensenware code, the "joke" could end up being pretty costly and damaging to everyone involved.

That said, Tvple Eraser seems genuinely apologetic for any unintended consequences of releasing what he thought was just a fun goof. "I'll NEVER make any malware or any similar thing," he writes on Twitter.