This new ransomware is targeting Windows and Linux PCs with a 'unique' attack

This new ransomware is targeting Windows and Linux PCs with a 'unique' attack 1

A newly uncovered form of ransomware is going after Windows and Linux systems in what appears to be a targeted campaign.

Named Tycoon after references in the code, this ransomware has been active since December 2019 and looks to be the work of cyber criminals who are highly selective in their targeting. The malware also uses an uncommon deployment technique which helps stay hidden on compromised networks. 

The main targets of Tycoon are organisations in the education and software industries.

Tycoon has been uncovered and detailed by researchers at BlackBerry working with security analysts at KPMG. It’s an unusual form of ransomware because it’s written in Java, deployed as a trojanised Java Runtime Environment and is compiled in a Java image file (Jimage) to hide the malicious intentions.

“These are both unique methods. Java is very seldom used to write endpoint malware because it requires the Java Runtime Environment to be able to run the code. Image files are rarely used for malware attacks,” Eric Milam, VP for research and intelligence at BlackBerry told ZDNet.

“Attackers are shifting towards uncommon programming languages and obscure data formats. Here, the attackers did not need to obscure their code were nonetheless successful in accomplishing their goals,” he added.

However, the first stage of Tycoon ransomware attacks is less uncommon, with the initial intrusion coming via insecure internet-facing RDP servers. This is a common attack vector for malware campaigns and it often exploits servers with weak or previously compromised passwords.

SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)    

Once inside the network, the attackers maintain persistence by using Image File Execution Options (IFEO) injection settings which more often provide developers with the ability to debug software. The attackers also use privileges to disable anti-malware software using ProcessHacker in order to stop removal of their attack.

“Ransomware can be implemented in high-level languages such as Java with no obfuscation and executed in unexpected ways,” said Milam.

After execution, the ransomware encrypts the network with files encrypted by Tycoon given extensions including .redrum, .grinch and .thanos – and the attackers demand a ransom in exchange for the decryption key. The attackers ask for payment in bitcoin and claim the price depends on how quickly the victim gets in touch via email.

The fact the campaign is still ongoing suggests that those behind it are finding success extorting payments from victims.

Researchers suggest that Tycoon could potentially be linked to another form of ransomware, Dharma – also known as Crysis – due to similarities in the email addresses, names of encrypted files and the text of the ransom note. 

And while Tycoon does have some unique means of executing an infection, like other forms of ransomware, it’s possible to prevent it from getting that far.

As RDP is a common means of compromise, organisations can ensure that the only ports facing outward to the internet are those which require it as an absolute necessity.

Organisations should also make sure that accounts which do need access to these ports aren’t using default credentials or weak passwords which can easily be guessed as a means of breaking in.

Applying security patches when they’re released can also prevent many ransomware attacks, as it stops criminals exploiting known vulnerabilities. Organisations should also ensure they regularly backup their network – and that the backup is reliable – so that if the worst happens, the network can be restored without giving into the demands of cyber criminals.

READ MORE ON CYBERSECURITY

About the author

E-Crypto News was developed to assist all cryptocurrency investors in developing profitable cryptocurrency portfolios through the provision of timely and much-needed information. Investments in cryptocurrency require a level of detail, sensitivity, and accuracy that isn’t required in any other market and as such, we’ve developed our databases to help fill in information gaps.

Related Posts

E-Crypto News Executive Interviews

Crypto Scams

Beanstalk Farms Loses $80M In A Massive DeFi Governance Flash-Loan Hack
Beanstalk Farms Loses $80M In A Massive DeFi Governance Flash-Loan Hack
April 23, 2022
Prove
Joon Pak Head of Crypto at Prove talks to Us about Crypto Fraud And More
April 11, 2022
Mintable
Mintable CEO Zach Burks Talks to Us about the Opensea Stolen NFTs and Their Recovery
March 21, 2022
Crypto Crime
Crypto Crime Surges To Record Highs As Thieves Follow Market Buzz – Chainalysis 2022 Report
February 24, 2022
Bots Circumvent 2FA Login At Coinbase And Other Crypto Exchanges In 2022
Bots Have Circumvented 2FA Logins At Coinbase And Other Crypto Exchanges In 2022
February 17, 2022

Automated trading with HaasBot Crypto Trading Bots

Blockchain/Cryptocurrency Questions and Answers

Russia
Roundtable Interview-What is the Effect of The Russia-Ukraine War on Cryptocurrency Prices?
March 4, 2022
GamStop
How Does Bitcoin Casino Work + 2021 Beginner’s Guide
November 8, 2021
Cryptocurrency
How to Buy and Sell Cryptocurrency
November 8, 2021
What Are Bitcoin Futures And How Will They Work In 2022?
November 4, 2021
Ethereum
The Unconventional Guide to Ethereum
October 28, 2021


CryptoCurrencyUSDChange 1hChange 24hChange 7d
Bitcoin28,865 0.30 % 2.31 % 5.00 %
Ethereum1,748.8 0.23 % 4.19 % 13.59 %
Tether1.001 0.02 % 0.07 % 0.03 %
USD Coin0.9989 0.16 % 0.08 % 0.04 %
BNB303.19 0.21 % 2.54 % 1.44 %
XRP0.3857 0.12 % 3.01 % 8.53 %
Binance USD1.001 0.01 % 0.05 % 0.23 %
Cardano0.9566 0.22 % 0.68 % 6.96 %
Solana41.45 0.73 % 5.88 % 20.80 %
Dogecoin0.08202 0.20 % 3.70 % 5.81 %

bitcoin
Bitcoin (BTC) $ 28,888.00
ethereum
Ethereum (ETH) $ 1,753.33
tether
Tether (USDT) $ 1.00
usd-coin
USD Coin (USDC) $ 1.00
bnb
BNB (BNB) $ 303.60
xrp
XRP (XRP) $ 0.38721
binance-usd
Binance USD (BUSD) $ 1.00
cardano
Cardano (ADA) $ 0.462297
solana
Solana (SOL) $ 41.73
dogecoin
Dogecoin (DOGE) $ 0.082567