Cyber Security News

Key Russian Hacker Group Attacking Users With .NET Built Ransomware

The Russian ransomware group Key Group, active since early 2023, is targeting organizations globally, as their modus operandi involves encrypting files and stealing data before demanding ransom via Telegram.

The group utilizes the .NET-based Chaos ransomware builder to create their malware, which poses a significant risk to organizations worldwide due to the potential for data loss and disruption of operations.

The ransomware infection cycle begins by encrypting files and appending a five-character random extension to their names. A list of targeted file types and processes to be terminated is embedded within the malware.

Targeted files

System recovery is disabled, while certain files are exempt from encryption. Once the encryption process is complete, a ransom message is displayed on the desktop demanding payment for decryption.

Decoding Compliance: What CISOs Need to Know – Join Free Webinar

The system appears to be compromised by Keygroup777 ransomware, as an indicator file named “keygroup777.txt” containing the ransom message was detected within the C:\SystemID\ directory.

The message directs to two URLs, where the first one leads to a login page but automatically redirects to a data recovery page, which is likely a decoy with no real data recovery functionality.

First Github link

The second link takes directly to the Key Group’s ransomware information page, which presumably provides instructions on how to pay for file decryption.

It’s important to exercise caution and avoid engaging with the attackers.

Data recovery through their methods is unreliable, and there’s a high chance of permanent data loss even after payment.

Instead, consider exploring alternative data recovery solutions or system restoration options.

The ransom page

The Telegram channel linked to @SpyWareSpyNet serves as a gateway to contact information for various operators, which contains links that redirect users to pages with audio tracks, such as T.A.t.i (feat. Ddeks) from ЧИЧ.

The buttons “About yourself” and “Satana” on these pages, when clicked, likely trigger communication with specific operators.

Additionally, the Telegram handle keygroup777Rezerv1 might be another channel or contact point for reaching operators.

Telegram channel for operator communication

The presence of these audio tracks and buttons suggests a structured system for interacting with operators.

Users may need to play specific audio tracks or select certain buttons to initiate or continue conversations, which could be a way to filter or categorize inquiries, or it might serve as a security measure to prevent unauthorized access

In order to protect individuals and organizations from any potential harm, the signature is able to detect and block this particular type of Trojan threat effectively.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN - 14-day free trial

Aman Mishra

Recent Posts

GitLab Security Update, Patch for Critical Vulnerabilities

GitLab announced the release of critical security patches for its Community Edition (CE) and Enterprise…

2 hours ago

BadRAM Attack Breaches AMD Secure VMs with $10 Device

Researchers have uncovered a vulnerability that allows attackers to compromise AMD's Secure Encrypted Virtualization (SEV)…

3 hours ago

Splunk RCE Vulnerability Let Attackers Execute Remote Code

Splunk, the data analysis and monitoring platform, is grappling with a Remote Code Execution (RCE)…

4 hours ago

Europol Shutsdown 27 DDoS Service Provider Platforms

In a major international operation codenamed “PowerOFF,” Europol, collaborating with law enforcement agencies across 15…

5 hours ago

Resecurity introduces Government Security Operations Center (GSOC) at NATO Edge 2024

Resecurity, a global leader in cybersecurity solutions, unveiled its advanced Government Security Operations Center (GSOC)…

19 hours ago

Reserachers Uncovered Zloader DNS Tunneling Tactics For Stealthy C2 Communication

Zloader, a sophisticated Trojan, has recently evolved with features that enhance its stealth and destructive…

19 hours ago