On June 9th, 2022, security researcher MalwareHunterTeam announced via Twitter a new ransomware named “WannaFriendMe.exe,” that uses Roblox, a popular online video game, for ransomware payments. The ransomware attempts to pass itself off as the Ryuk ransomware, a well-known strain of ransomware attributed to the Wizard Spider threat actor, by labeling the encrypted files with the “.ryuk” extension, but analysis determined it was created with the Chaos ransomware builder sold on underground forums. The Chaos ransomware builder is known as “skidware,” meaning its only users are “script kiddies” and the malware is not high quality. In testing, Chaos ransomware has been shown to destructively encrypt files, causing the decryptors to be unable to restore encrypted data over a certain size. What makes the WannaFriendMe ransomware strain interesting is its demand of payment in Roblox game currency “Robux,” rather than traditional cryptocurrencies. In the ransom note, the ransomware links a game on the Roblox store named “Ryuk Decrypter” that costs a total of 1,499 Robux (under $20 USD). This ransom demand is small compared to most other ransomware, likely meaning the threat actor is not experienced and may not have the ability target many organizations or users. Due to the issues with the encryption method, CTIX analysts recommend victims of this ransomware not pay the ransom demand and instead rely on backups to ensure files can be restored.