New Eldorado Ransomware Attacking Windows And Linux Systems

Ransomware-as-a-service (RaaS) has evolved into sophisticated enterprise-like model. From 2022 to 2023, ransomware programs advertised on the dark web increased by half, with 27 ads identified.

The RAMP forum was made the main hub of hiring for ransomware. Attacks published on specific leak sites rose by a margin of 74% which reached 4,583 in 2023.

This suggests an evolving and structured ecosystem of threat actors specializing in deploying ransomware.

Cybersecurity researchers at Group-IB recently identified that the new Eldorado ransomware has been attacking the Windows and Linux systems.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.

Eldorado Ransomware-as-a-service

In March 2024, a new ransomware affiliate program called Eldorado emerged on the RAMP forum. 

Developed by Russian-speaking actors, it uses custom-built malware for Windows and Linux, employing Golang, Chacha20, and RSA-OAEP encryption. 

By June 2024, Eldorado had attacked 16 companies, primarily in the US (81.25%), with Real Estate being the most targeted industry (18.75%). The group uses a dark web chat platform and a leak site for operations.

It was written in Golang, a programming language that can run on different operating systems, so it can infect both Microsoft and Linux users.

It adds “.00000001” to the names of all the files it encrypts and also uses personalized ransom notes.

The payload has command line parameters, a configuration compressed with gzip, logging to a specific IP over websockets, and if correctly provided with username/password combination, would also encrypt shared network files within an organization using SMB protocol.

Eldorado ransomware uses Chacha20 for file encryption and RSA-OAEP for key encryption. Besides this, it also generates unique keys for each file as well. 

Post-encryption, it self-destructs by overwriting with random bytes and deleting itself, unless specified otherwise. Even it also removes the Windows shadow volume copies. 

The Linux version is simpler, only encrypting the specified directories recursively.

Threat actors always change their strategies, even though ransomware is becoming more popular.

This trend is best exemplified by the Eldorado group, which quickly become a significant risk with its sophisticated cross-platform ransomware.

The dynamic nature of the ransomware threat is brought out by their success and the ongoing creation of new strains of malware and affiliate programs.

Organizations should consequently remain vigilant as this threat remains persistent and they have to change their cybersecurity approach.

Recommendations

Here below we have mentioned all the recommendations:-

• Implement multi-factor authentication (MFA)
• Use Endpoint Detection and Response (EDR) for early threat detection.
• Maintain regular data backups
• Deploy advanced malware detonation solutions
• Prioritize timely security patching
• Conduct employee cybersecurity training
• Perform regular vulnerability assessments
• Avoid paying ransoms

IoCs

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo