Key Russian Hacker Group Attacking Users With .NET Built Ransomware

The Russian ransomware group Key Group, active since early 2023, is targeting organizations globally, as their modus operandi involves encrypting files and stealing data before demanding ransom via Telegram.

The group utilizes the .NET-based Chaos ransomware builder to create their malware, which poses a significant risk to organizations worldwide due to the potential for data loss and disruption of operations.

The ransomware infection cycle begins by encrypting files and appending a five-character random extension to their names. A list of targeted file types and processes to be terminated is embedded within the malware.

System recovery is disabled, while certain files are exempt from encryption. Once the encryption process is complete, a ransom message is displayed on the desktop demanding payment for decryption.

Decoding Compliance: What CISOs Need to Know – Join Free Webinar

The system appears to be compromised by Keygroup777 ransomware, as an indicator file named “keygroup777.txt” containing the ransom message was detected within the C:\SystemID\ directory.

The message directs to two URLs, where the first one leads to a login page but automatically redirects to a data recovery page, which is likely a decoy with no real data recovery functionality.

The second link takes directly to the Key Group’s ransomware information page, which presumably provides instructions on how to pay for file decryption.

It’s important to exercise caution and avoid engaging with the attackers.

Data recovery through their methods is unreliable, and there’s a high chance of permanent data loss even after payment.

Instead, consider exploring alternative data recovery solutions or system restoration options.

The Telegram channel linked to @SpyWareSpyNet serves as a gateway to contact information for various operators, which contains links that redirect users to pages with audio tracks, such as T.A.t.i (feat. Ddeks) from ЧИЧ.

The buttons “About yourself” and “Satana” on these pages, when clicked, likely trigger communication with specific operators.

Additionally, the Telegram handle keygroup777Rezerv1 might be another channel or contact point for reaching operators.

The presence of these audio tracks and buttons suggests a structured system for interacting with operators.

Users may need to play specific audio tracks or select certain buttons to initiate or continue conversations, which could be a way to filter or categorize inquiries, or it might serve as a security measure to prevent unauthorized access

In order to protect individuals and organizations from any potential harm, the signature is able to detect and block this particular type of Trojan threat effectively.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN - 14-day free trial