Chaos Malware Walks Line Between Ransomware and Wiper

guest · Aug 10, 2021

Chaos Malware Walks Line Between Ransomware and Wiper
The dangerous malware has been rapidly developed since June and could be released into the wild soon.
August 10, 2021
https://threatpost.com/chaos-malware-ransomware-wiper/168520/

An under-construction malware called Chaos has been spotted, which is being advertised on an underground forum as being available for testing. While it calls itself ransomware, an analysis revealed that it’s actually more of a wiper.

According to Trend Micro researcher Monte de Jesus, Chaos has been around since June, and has already cycled through four different versions, with the last one being released on August 5. This rapid development could mean that it will soon be ready for primetime, but so far it hasn’t been used in actual attacks, he said.
Click to expand...

Chaos started out purporting to be a .NET version of the Ryuk ransomware – a ruse it went all in on, complete with Ryuk branding on its GUI.
Instead, the sample is “more akin to a destructive trojan than to traditional ransomware,” he noted, in a Tuesday analysis.
Click to expand...

“One of the more interesting functions of Chaos version 1.0 was its worming function, which allowed it to spread to all drives found on an affected system,” de Jesus wrote. “This could permit the malware to jump onto removable drives and escape from air-gapped systems.”
Click to expand...

Trend Micro: Chaos Ransomware: A Proof of Concept With Potentially Dangerous Applications

Since June 2021, we’ve been monitoring an in-development ransomware builder called Chaos, which is being offered for testing on an underground forum.
Click to expand...

EASTER · Aug 10, 2021

Aptly named right? Wonder what makes this one so different than other traditionals besides the wormy feature

This version of Chaos also had other notable tricks up its sleeve.

Chaos became more ransomware-ish with version 3.0, when it added encryption to the mix. This sample had the ability to encrypt files under 1 MB using AES/RSA encryption, and featured a decryptor-builder, according to the researcher.

Then, in early August, the fourth iteration of Chaos appeared on the forum, with an expansion of the AES/RSA encryption feature. Now, files up to 2MB in size can be encrypted. And, operators can append encrypted files with their own proprietary extensions, like other ransomwares, according to the analysis. It also offers the ability to change the desktop wallpaper of their victims.
Click to expand...

Essentially, Chaos is for now a proof-of-concept malware, according to the researcher – but one that “could be dangerous in the wrong hands” thanks to its ability to wipe out files.
Click to expand...

guest · Oct 30, 2021

Chaos ransomware targets gamers via fake Minecraft alt lists
October 10, 2021
https://www.bleepingcomputer.com/ne...-targets-gamers-via-fake-minecraft-alt-lists/

The Chaos Ransomware gang encrypts gamers' Windows devices through fake Minecraft alt lists promoted on gaming forums.

Minecraft is a massively popular sandbox video game currently played by over 140 million people, and according to Nintendo sales numbers, it's a top-seller title in Japan.
Click to expand...

Masked as an 'alt list' text file
According to researchers at FortiGuard, a recently discovered variant of the Chaos ransomware is being tentatively distributed in Japan, encrypting the files of Minecraft players and dropping ransom notes.

The lure used by the threat actors are 'alt list' text files that supposedly contain stolen Minecraft account credentials, but in reality, is Chaos ransomware executable.
Click to expand...

A destructive infection
This particular variant of the Chaos Ransomware is configured to search the infected systems for different file types smaller than 2ΜΒ and encrypts them.
Due to the destructive nature of the attack, those who pay the ransom can only recover smaller files.

In this particular campaign, the threat actors are promoting text files to create a false sense of security while swapping them out in the end with executables.
Click to expand...

FortiGuard: Chaos Ransomware Variant in Fake Minecraft Alt List Brings Destruction to Japanese Gamers

Minecraft is one of the most popular digital games in the world. It was originally released in May 2009 by Swedish game developer Mojang Studios, which was acquired by Microsoft in 2014 for US $2.5 billon. Initially released for the Windows, Mac, and Linux platforms, the game is now available on 22 platforms including video game consoles and mobile devices, including Android and iOS. As its gaming population has steadily grown, reaching more than 140 million monthly active players in August 2021, Minecraft has never been more popular 12 years after its initial release. Evidently, cybercriminals cannot pass up the opportunity to target such a large userbase.

FortiGuard Labs recently discovered a variant of the Chaos ransomware that appears to target Minecraft gamers in Japan. This variant not only encrypts certain files but also destroys others, rendering them unrecoverable. If gamers fall prey to the attack, choosing to pay the ransom may still lead to a loss of data. In this report we will take a look at how this new ransomware variant works.
Click to expand...

Log in or Sign up

Chaos Malware Walks Line Between Ransomware and Wiper

guest Guest

EASTER Registered Member

guest Guest

Log in or Sign up

Chaos Malware Walks Line Between Ransomware and Wiper

guest Guest

EASTER Registered Member

guest Guest

Useful Searches