Feature-rich Ensiko malware can encrypt, targets Windows, macOS, Linux

guest · Jul 28, 2020

Feature-rich Ensiko malware can encrypt, targets Windows, macOS, Linux
July 28, 2020
https://www.bleepingcomputer.com/ne...ware-can-encrypt-targets-windows-macos-linux/

Threat researchers have found a new feature-rich malware that can encrypt files on any system running PHP, making it a high risk for Windows, macOS, and Linux web servers.

The malware received the name Ensiko and is a web shell written in PHP. Attackers can use it to remotely control a compromised system and run a host of malicious activities.
Variety of options
From Ensiko’s large list of capabilities, the file-encryption component stands out as it can be used for ransomware attacks against servers.
Researchers at Trend Micro analyzed the malware and found that it uses the symmetric Rijnadel-128 cipher in CBC mode to encrypt files.
Click to expand...

One of the functions of the malware is called Steganologer, which can identify image files that have code in their metadata (EXIF headers). The code is then extracted and executed on the compromised server.
Trend Micro malware analyst Aliakbar Zahravi discovered that Ensiko can also check if a web shell from a predefined list is present on a remote host.

Ensiko’s capabilities do not stop at this, though. The malware lets threat actors run brute-force attacks on FTP, cPanel, and Telnet, thus enabling them extended access.
Click to expand...

Trend Micro: Ensiko: A Webshell With Ransomware Capabilities

Ensiko is a PHP web shell with ransomware capabilities that targets various platforms such as Linux, Windows, macOS, or any other platform that has PHP installed. The malware has the capability to remotely control the system and accept commands to perform malicious activities on the infected machine.
Click to expand...

Log in or Sign up

Feature-rich Ensiko malware can encrypt, targets Windows, macOS, Linux

guest Guest

Log in or Sign up

Feature-rich Ensiko malware can encrypt, targets Windows, macOS, Linux

guest Guest

Useful Searches