Friday, November 8, 2024
HomeCyber CrimeNew Eldorado Ransomware Attacking Windows And Linux Systems

New Eldorado Ransomware Attacking Windows And Linux Systems

Published on

Malware protection

Ransomware-as-a-service (RaaS) has evolved into sophisticated enterprise-like model. From 2022 to 2023, ransomware programs advertised on the dark web increased by half, with 27 ads identified.

The RAMP forum was made the main hub of hiring for ransomware. Attacks published on specific leak sites rose by a margin of 74% which reached 4,583 in 2023.

This suggests an evolving and structured ecosystem of threat actors specializing in deploying ransomware.

- Advertisement - SIEM as a Service

Cybersecurity researchers at Group-IB recently identified that the new Eldorado ransomware has been attacking the Windows and Linux systems.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.

Eldorado Ransomware-as-a-service

In March 2024, a new ransomware affiliate program called Eldorado emerged on the RAMP forum. 

Developed by Russian-speaking actors, it uses custom-built malware for Windows and Linux, employing Golang, Chacha20, and RSA-OAEP encryption. 

New Eldorado Ransomware (Source – Group-IB)

By June 2024, Eldorado had attacked 16 companies, primarily in the US (81.25%), with Real Estate being the most targeted industry (18.75%). The group uses a dark web chat platform and a leak site for operations.

It was written in Golang, a programming language that can run on different operating systems, so it can infect both Microsoft and Linux users.

It adds “.00000001” to the names of all the files it encrypts and also uses personalized ransom notes.

Ransom note (Source – Group-IB)

The payload has command line parameters, a configuration compressed with gzip, logging to a specific IP over websockets, and if correctly provided with username/password combination, would also encrypt shared network files within an organization using SMB protocol.

Eldorado ransomware uses Chacha20 for file encryption and RSA-OAEP for key encryption. Besides this, it also generates unique keys for each file as well. 

Post-encryption, it self-destructs by overwriting with random bytes and deleting itself, unless specified otherwise. Even it also removes the Windows shadow volume copies. 

The Linux version is simpler, only encrypting the specified directories recursively.

Threat actors always change their strategies, even though ransomware is becoming more popular.

This trend is best exemplified by the Eldorado group, which quickly become a significant risk with its sophisticated cross-platform ransomware.

The dynamic nature of the ransomware threat is brought out by their success and the ongoing creation of new strains of malware and affiliate programs.

Organizations should consequently remain vigilant as this threat remains persistent and they have to change their cybersecurity approach.

Recommendations

Here below we have mentioned all the recommendations:-

  • Implement multi-factor authentication (MFA)
  • Use Endpoint Detection and Response (EDR) for early threat detection.
  • Maintain regular data backups
  • Deploy advanced malware detonation solutions
  • Prioritize timely security patching
  • Conduct employee cybersecurity training
  • Perform regular vulnerability assessments
  • Avoid paying ransoms

IoCs

IoCs (Source – Group-IB)

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability...

Cisco Desk Phone Series Vulnerability Lets Remote Attacker Access Sensitive Information

A significant vulnerability (CVE-2024-20445) has been discovered in Cisco Desk Phone 9800 Series, IP...

Cisco Flaw Let Attackers Run Command as Root User

A critical vulnerability has been discovered in Cisco Unified Industrial Wireless Software, which affects...

Researchers Detailed Credential Abuse Cycle

The United States Department of Justice has unsealed an indictment against Anonymous Sudan, a...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability...

Cisco Desk Phone Series Vulnerability Lets Remote Attacker Access Sensitive Information

A significant vulnerability (CVE-2024-20445) has been discovered in Cisco Desk Phone 9800 Series, IP...

Cisco Flaw Let Attackers Run Command as Root User

A critical vulnerability has been discovered in Cisco Unified Industrial Wireless Software, which affects...