Thursday, May 22, 2025
HomeRansomwareA New Ransomware Dubbed BlackCocaine Uses AES & RSA Encryption Methods

A New Ransomware Dubbed BlackCocaine Uses AES & RSA Encryption Methods

Published on

SIEM as a Service

Follow Us on Google News

Recently, an Indian IT company that is specialized in the Banking and Financial Services sector, Nucleus Software has suffered a security breach on May 30, 2021, as reported by the cybersecurity experts at Cyble.

However, Nucleus Software has already reported the Bombay Stock Exchange (BSE) and the National Stock Exchange of India (NSEI) about this security breach. 

The company noted that the probability of financial data leak is dubious, as Nucleus Software has confirmed that they don’t store any financial data of its customers.

- Advertisement - Google News

During the investigation, the security researchers at Cyble has discovered that this cyber attack is executed by the group behind the BlackCocaine Ransomware, and from the below image you can see the compromised page of BlackCocaine ransomware.

Technical Analysis

Here, the analysts assert that the first victim of the BlackCocaine ransomware group is Nucleus Software and they have also revealed the malicious website of BlackCocaine ransomware group:-

  • hxxp://blackcocaine[.]top/

On May 28, 2021, the above-mentioned domain name was registered by the BlackCocaine ransomware group. The security authorities at Cyble discovered the BlackCocaine ransomware sample files during their routine exercises.

The operators of BlackCocaine ransomware have used the MinGW tool to compile the ransomware payload file that is a UPX-packed 64-bit Windows executable file. 

While the threat actors have used the Go language to program this malicious executable, and on May 29, 2021, the operators behind this attack have compiled this executable file. 

After manually extracting the ransomware payload, the experts concluded that to evade several security analysis tools and make this more complicated threat actors have used various anti-VM and anti-debugging methods.

Here, while encrypting the victim documents to perform file system inventory, the BlackCocaine ransomware decrypts Windows APIs. After completing this stage, it automatically affixes the “.BlackCocaine” extension to the filenames of each encrypted file.

Moreover, cybersecurity researchers have concluded that in this attack the AES and RSA Encryption methods are used by the operators behind this BlackCocaine ransomware. 

After the successful encryption process, on the infected system, the threat actors drops a ransom note:- 

  • “HOW_TO_RECOVER_FILES.BlackCocaine.txt” 

Recommendations

The experts have suggested few recommendations and here they are mentioned below:-

  • To track and block the malware infection always use the shared IoCs.
  • Use strong passwords.
  • Use multi-factor authentication.
  • Turn on the automatic software update.
  • Use security tools.
  • Avoid opening untrusted links and email attachments.
  • Use the service provided by the AmiBreached.com portal to track your exposure in the Darkweb.

The BlackCocaine ransomware is one of the active and sophisticated malware strains; but, to lock the data and demand ransom from the victim the BlackCocaine uses the same standard of server-side encryption method.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Target Mobile Users Using PWA JavaScript to Bypass Browser Security

A sophisticated new injection campaign has been uncovered, targeting mobile users through malicious third-party...

Docker Zombie Malware Infects Containers for Crypto Mining and Self-Replication

A novel malware campaign targeting containerized infrastructures has emerged, exploiting insecurely exposed Docker APIs...

Hackers Masquerade as Organizations to Steal Payroll Logins and Redirect Payments from Employees

ReliaQuest, hackers have deployed a cunning search engine optimization (SEO) poisoning scheme to orchestrate...

PupkinStealer Exploits Web Browser Passwords and App Tokens to Exfiltrate Data Through Telegram

A newly identified .NET-based information-stealing malware, dubbed PupkinStealer (also known as PumpkinStealer in some...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

VanHelsing Ransomware Builder Exposed on Hacker Forums

The cybersecurity landscape reveal that the VanHelsing ransomware operation has experienced a significant security...

LockBit Internal Data Leak Reveals Payload Creation Methods and Ransom Demands

The notorious ransomware group LockBit inadvertently suffered a major data breach, exposing the inner...

Kettering Health Experiences System-Wide Outage Due to Ransomware Attack

Kettering Health, a major healthcare provider, has been hit by what appears to be...