Ransomware Targeting Windows and Linux Servers

Cybercriminals are constantly developing new techniques to target potential victims without being caught. This is especially true for ransomware attackers who enter an organization's network and encrypt sensitive files there, virtually taking them hostage. 'tycoonA new ransomware called ', java It targets Windows and Linux servers using The report, published by BlackBerry Research and Intelligence Team and KPMG UK Cyber ​​Response Services, sheds light on how these attacks are organized.

Tycoon, seen since last December, is a multiplatform Java ransomware and its target Windows And Linux files on their servers. Tycoon uses JIMAGE, an obscure Java image format, to avoid exposure. JIMAGE is used by the Java Virtual Machine (JVM) during its operation. java Runtime Environment It stores (JRE) images. Specifically, Tycoon ransomware comes as a ZIP file containing the infected JRE assembly. Although ransomware has used Java before, this time it uses the JIMAGE format to create a personalized and malicious file. JRE with compilation first times is encountered.

The target companies and educational institutions are:

The ransomware appears to target small and medium-sized companies, educational institutions, and software companies. The first infection was from an internet-connected RDP It takes place through the (Remote Desktop Protocol) server. This system is used to control other devices through its own secure zone. After attacking the domain controller and file servers, hackers forced system administrators to hack into their machines. outside leaving. 

Afterwards, by launching the 'hacker-as-server' process and disabling local antivirus security, the attackers infiltrate the compromised system. back door quits and leaves the network. The attacker then connects to an RDP server and uses it to move horizontally across the network. By manually initiating an RDP connection on each server, the hacker runs the process, disabling security protection and creating a file to launch the ransomware. stack file running it.

Files whose confidentiality has been violated, Galois/counter In (GCM) mode, it comes with a 16 Byte GCM authentication tag to ensure data integrity. ES-256 It is stated that it is encrypted with the algorithm. By not encrypting certain parts of larger files, attackers speed up the process but still manage to render the files unusable. Files, asymmetrical RSA algorithm It is encrypted using . Thus, to crack these passwords, the attacker's private RSA key is needed, which requires huge amounts of computing power to find.

Although Tycoon has been on the market for about 6 months, the number of people affected by these attacks is annoyed It is stated that . In this case, the attacks were either directed at specific organizations or different type It's part of a larger attack using ransomware.