Linux version of RansomEXX ransomware discovered

mood · Nov 6, 2020

Linux version of RansomEXX ransomware discovered
This marks the first time a major Windows ransomware strain has been ported to Linux to aid hackers in their targeted intrusions
November 6, 2020
https://www.zdnet.com/article/linux-version-of-ransomexx-ransomware-discovered/

Security firm Kaspersky said today that it discovered a Linux version of the RansomEXX ransomware, marking the first time a major Windows ransomware strain has been ported to Linux to aid in targeted intrusions.
RansomEXX is a relatively new ransomware strain that was first spotted earlier this year in June.

RansomEXX is what security researchers call a "big-game hunter" or "human-operated ransomware." These two terms are used to describe ransomware groups that hunt large targets in search for big paydays, knowing that some companies or government agencies can't afford to stay down while they recover their systems.
These groups buy access or breach networks themselves, expand access to as many systems as possible, and then manually deploy their ransomware binary as a final payload to cripple as much of the target's infrastructure as possible.
Click to expand...

The RansomEXX gang creating a Linux version of their Windows ransomware is in tune with how many companies operate today, with many firms running internal systems on Linux, and not always on Windows Server.

The RansomEXX Linux version makes perfect sense from an attacker's perspective, who is always looking to expand and touch as much core infrastructure as possible in their quest to cripple companies and demand higher ransoms.
Click to expand...

What we see from RansomEXX may soon turn out to be an industry-defining trend, with other big ransomware groups rolling out their Linux versions in the future as well.
Click to expand...

Kaspersky: RansomEXX Trojan attacks Linux systems

We recently discovered a new file-encrypting Trojan built as an ELF executable and intended to encrypt data on machines controlled by Linux-based operating systems.

RansomEXX is a highly targeted Trojan. Each sample of the malware contains a hardcoded name of the victim organization. Moreover, both the encrypted file extension and the email address for contacting the extortionists make use of the victim’s name.
Click to expand...

mood · Sep 30, 2021

RansomExx ransomware Linux encryptor may damage victims' files
September 30, 2021
https://www.bleepingcomputer.com/ne...are-linux-encryptor-may-damage-victims-files/

In a new report by Profero, Senior Incident Responder Brenton Morris says the RansomEXX decryptor was failing on various files encrypted by the threat actor's Linux Vmware ESXI encryptor for one the victims who paid the ransom.

After reverse-engineering the RansomExx Linux encryptor, Profero discovered that the problematic decryption was caused by Linux files not being adequately locked while they were encrypted.
Without the file being locked, if the ransomware attempted to encrypt a Linux file simultaneously as another process wrote to it, the encrypted file would contain both encrypted data and unencrypted data appended after it, as shown below.

"Some strains of Linux ransomware will attempt to acquire a file lock using fcntl while others will often not attempt to lock files for writing, and instead either knowingly choose to take the risk of corrupting the files or do so unknowingly due to lack of Linux programming experience," Morris told BleepingComputer.
Click to expand...

Fixed decryptor released
To aid their clients and the greater cybersecurity community, Profero has released an open-source RansomEXX decryptor that can decrypt files encrypted with this file locking issue.

"Because the attackers provide paying victims with a decryption tool they must run to decrypt their files there is a risk that the decryption tool may be malicious. This requires affected victims to reverse engineer the provided decryption tool to ensure there is no hidden payload or malicious features, a time investment that can be problematic for some organizations during a ransomware incident," explains Profero's blog post.
Click to expand...

Log in or Sign up

Linux version of RansomEXX ransomware discovered

mood Updates Team

mood Updates Team