• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer
  • Jobs
  • Career
    • Cyber Security Training
    • Work from Home
    • Cyber Security Analyst
    • Remote Work – Six Ways to Keep Your Data Safe When Working Remotely
  • Field Guide
  • Newsletter Signup
  • Deals
  • News
AskCyberSecurity.com

AskCyberSecurity.com

Cyber Security News & Information

  • Home
  • Data Privacy
    • Gamers
    • Government Cyber Security
      • Legislation
      • Standards
        • What are the risks of computer security?
        • Medical Cyber Security
    • Social Media
  • Security
    • Data Breaches
    • Scams
    • Malware
  • Software
    • Apps
    • Web Browsers
  • Glossary
    • Cyber Security Acronyms
  • About Ask Cyber Security
    • Authors
    • Contact Us
  • VPN
    • How Do I Know If My VPN is Working?
    • Best Free VPN iPhone
    • Why Use a VPN?
    • NordVPN vs IPVanish
    • Private Internet Access Download
    • Best VPN for Streaming
      • TikTok VPN
    • VPN Porn
    • Computer Security Software – What You Really Need
  • Tutorials
AskCyber Home » News » Malware » Tycoon Ransomware Targets Education and Software Companies

Tycoon Ransomware Targets Education and Software Companies

2020-06-05 by Max

Tycoon Malware

Tycoon Ransomware Used to Infiltrate Small to Medium Education and Software Companies

New ransomware is targeting education and software companies. The malware, known as Tycoon ransomware, was spotted by The BlackBerry Research and Intelligence Team and the KPMG UK Cyber Response Services team. It encrypts all servers including backup systems connected to the compromised network says the report from Blackberry.

Tycoon malware targets both Windows and Linux machines. Like many ransomware attacks, the hackers demand to be paid in Bitcoin. The demand for payments states that the price for releasing control of the encrypted files will increase ten percent every day if it is not paid within 60 hours.

The hackers leave a note stating that all documents, photos, databases, and other files have been encrypted. The malware used three file extensions, thanos, grinch, and redrum, for the encrypted files. After it’s compromised, the victim organization is informed that they must buy decryption software and a private key using Bitcoin. The hackers offer a proof of concept service by offering to decrypt five files for free.

READ: Beware of Fake VPN Alerts Scamming Office 365 Logins

In this Tycoon Ransomware cyber attack detailed by Blackberry, the system administrators were been locked out of all systems following the attack on their domain controller and file servers. The hackers had compromised a system using a Remote Desktop Protocol (RDP) server on the target network and obtained local administrator credentials. After that, they installed process hacker-as-a-service and disabled the organization’s anti-malware solution. The hacker left the network but not before leaving a backdoor for themselves. A week later the hacker connected to an RDP server and used it to move laterally across the network. They were able to make RDP connections to multiple servers. The RDP connections were manually initiated where the attacker ran process hacker-as-a-service and disabled antivirus, then executed the ransomware.

The compromised company was not named in the report. Blackberry reports the attacks seemed to be targeted and the number of victims limited.

Tycoon is deployed as a Trojanized Java Runtime Environment and compiled into a Java image file – the use of which is new to ransomware attacks.  This ransomware was first seen in December 2019.

Tycoon Ransomware Encrypted File Extensions

  • thanos
  • grinch
  • redrum

The malware configuration is stored in the project’s BuildConfig file and these email addresses

  • pay4dec[at]cock[.]lu
  • dataissafe[at]protonmail[.]com
  • dataissafe[at]mail[.]com
  • foxbit[at]tutanota[.]com
  • moncler[at]tutamail[.]com
  • moncler[at]cock[.]li
  • relaxmate[at]protonmail[.]com
  • crocodelux[at]mail[.]ru
  • savecopy[at]cock[.]li
  • bazooka[at]cock[.]li
  • funtik[at]tutamail[.]com
  • proff-mariarti[at]protonmail[.]com

“Malware writers are constantly seeking new ways of flying under the radar. They are slowly moving away from conventional obfuscation and shifting towards uncommon programming languages and obscure data formats,” the report from BlackBerry says.

According to BlackBerry , “Tycoon has been in the wild for at least six months, but there seems to be a limited number of victims. This suggests the malware may be highly targeted.”

READ: EventBot Android Malware Steals Banking App Credentials

How is Tycoon Ransomware Delivered?

Tycoon ransomware comes in form of a ZIP archive containing a Trojanized Java Runtime Environment build. The malware is compiled into a Java image file located at lib\modules within the build directory.

Filed Under: Malware Tagged With: Tycoon

About Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.


LinkedInTwitterFacebook

Primary Sidebar

Subscribe to Our Free Newsletter

We Don't Share or Sell Your Info

Web Browsers

Where Are My Saved Passwords in Chrome?

Google Removes 70 Malicious Browser Add-ons from Chrome Web Store

Firefox 75 Reports Your Browser Settings to Mozilla

Categories

Cyber Security Field Guide

Computer Security While TravelingGet Our Cyber Security Field Guide - Available on Amazon!

Recent Posts

Security Marketing Manager – Remote

Sr. Associate, Cybersecurity Architect – Pfizer

Strategic Customer Success Manager – Cybersecurity – Opportunity for Working Remotely

Top 20 Passwords Leaked on Dark Web

ISU Cybersecurity Leader Job Opening

Cyber Security News

Top 20 Passwords Leaked on Dark Web

… [Read More...] about Top 20 Passwords Leaked on Dark Web

Apple Warns of Actively Exploited Zero-Day Flaw

… [Read More...] about Apple Warns of Actively Exploited Zero-Day Flaw

IRS Stops Facial Recognition System for Online Access

… [Read More...] about IRS Stops Facial Recognition System for Online Access

National Cybersecurity Alliance Announces Data Privacy Week

… [Read More...] about National Cybersecurity Alliance Announces Data Privacy Week

More Cyber Security News

Tags

amazon Android Apple bitcoin China chrome CISA credit card DarkSide DHS DOJ Equifax Europe Facebook facial recognition FBI Firefox FTC games GDPR Google Government hacker identity theft India iPhone Iran IRS LinkedIn Microsoft North Korea PayPal phishing phishing email ransomware REvil Russia smartphone T-Mobile TikTok tutorial VPN WhatsApp WiFi Windows

Government

CBP Looks to Access Airline Passenger Data

FTC Releases Cyber Threat Video Playlist

Malware Found on US Government Funded Phones

UK NCA Reaches Out to Youth to Deter Cybercrimes

More Posts from this Category

Footer

Menu

  • Home
  • About
  • Authors
  • Newsletter Signup
  • PRIVACY POLICY

Search

Why Use a VPN?

NordVPN vs IPVanish VPN Review

NAVIGATION

  • Data Breaches
  • Data Privacy
  • Gamers
  • Scams
  • Malware

MEMBER NJCCIC

New Jersey Cybersecurity & Communications Integration Cell

STAY CONNECTED

  • Facebook
  • Instagram
  • Pinterest
  • YouTube
  • Twitter
  • RSS

Copyright © 2023 · AskCyberSecurity.com · METRONY, LLC

Go to mobile version