Tycoon Ransomware Used to Infiltrate Small to Medium Education and Software Companies
New ransomware is targeting education and software companies. The malware, known as Tycoon ransomware, was spotted by The BlackBerry Research and Intelligence Team and the KPMG UK Cyber Response Services team. It encrypts all servers including backup systems connected to the compromised network says the report from Blackberry.
Tycoon malware targets both Windows and Linux machines. Like many ransomware attacks, the hackers demand to be paid in Bitcoin. The demand for payments states that the price for releasing control of the encrypted files will increase ten percent every day if it is not paid within 60 hours.
The hackers leave a note stating that all documents, photos, databases, and other files have been encrypted. The malware used three file extensions, thanos, grinch, and redrum, for the encrypted files. After it’s compromised, the victim organization is informed that they must buy decryption software and a private key using Bitcoin. The hackers offer a proof of concept service by offering to decrypt five files for free.
READ: Beware of Fake VPN Alerts Scamming Office 365 Logins
In this Tycoon Ransomware cyber attack detailed by Blackberry, the system administrators were been locked out of all systems following the attack on their domain controller and file servers. The hackers had compromised a system using a Remote Desktop Protocol (RDP) server on the target network and obtained local administrator credentials. After that, they installed process hacker-as-a-service and disabled the organization’s anti-malware solution. The hacker left the network but not before leaving a backdoor for themselves. A week later the hacker connected to an RDP server and used it to move laterally across the network. They were able to make RDP connections to multiple servers. The RDP connections were manually initiated where the attacker ran process hacker-as-a-service and disabled antivirus, then executed the ransomware.
The compromised company was not named in the report. Blackberry reports the attacks seemed to be targeted and the number of victims limited.
Tycoon is deployed as a Trojanized Java Runtime Environment and compiled into a Java image file – the use of which is new to ransomware attacks. This ransomware was first seen in December 2019.
Tycoon Ransomware Encrypted File Extensions
- thanos
- grinch
- redrum
The malware configuration is stored in the project’s BuildConfig file and these email addresses
- pay4dec[at]cock[.]lu
- dataissafe[at]protonmail[.]com
- dataissafe[at]mail[.]com
- foxbit[at]tutanota[.]com
- moncler[at]tutamail[.]com
- moncler[at]cock[.]li
- relaxmate[at]protonmail[.]com
- crocodelux[at]mail[.]ru
- savecopy[at]cock[.]li
- bazooka[at]cock[.]li
- funtik[at]tutamail[.]com
- proff-mariarti[at]protonmail[.]com
“Malware writers are constantly seeking new ways of flying under the radar. They are slowly moving away from conventional obfuscation and shifting towards uncommon programming languages and obscure data formats,” the report from BlackBerry says.
According to BlackBerry , “Tycoon has been in the wild for at least six months, but there seems to be a limited number of victims. This suggests the malware may be highly targeted.”
READ: EventBot Android Malware Steals Banking App Credentials
How is Tycoon Ransomware Delivered?
Tycoon ransomware comes in form of a ZIP archive containing a Trojanized Java Runtime Environment build. The malware is compiled into a Java image file located at lib\modules within the build directory.
