Saturday, December 14, 2024
HomeUncategorizedTycoon Ransomware - New Java Based Ransomware Attack Windows & Linux...

Tycoon Ransomware – New Java Based Ransomware Attack Windows & Linux Users

Published on

SIEM as a Service

Security experts have warned that hackers are using a new multi-platform Java ransomware “Tycoon” to target Windows and Linux users to lock down the files.

We all know that hackers are constantly looking for new means to attack data centers and systems of normal users to steal essential data and information.

Since Microsoft Windows is the most used OS, that’s why hackers are making it as their target. hackers are paying more and more attention to other operating systems as well, like macOS and Linux. 

- Advertisement - SIEM as a Service

As hackers are betting massively on multi-platform malware and ransomware, that affects all the major platforms. The main goal of this critical vulnerability is to infect the SMBs in the software and education industries.

Tycoon Ransomware

Security experts at BlackBerry Research and Intelligence Team in association with KPMG’s UK Cyber ​​Response Services have named this ransomware as “Tycoon,” and it has been in operation since the end of 2019.

Here the main feature of Tycoon Ransomware is infecting all Windows and Linux users equally since it is a ransomware that is written in Java programming language.

Hackers hide the Tycoon inside a modified ZIP file that executes the trojan when the victim opens it. They commonly use the RDP server and vulnerable networks to sneak into the systems.

Once the hacker managed to run the ransomware on the victim’s system, it starts gaining persistence on the system, and to do this, it performs an IFEO (Image file execution options) injection in the Windows on-screen keyboard function.

It also changes the Active Directory password as well and disables the antivirus and then installs the ProcessHacker hacker-as-a-service utility tool.

After completing all these steps, the ransomware begins to encrypt all the data present on the computer and on the network drives.

Once everything is done, it automatically sends the private key to the hacker securely, then it destroys the private key from the victim’s system, and finally, it displays the surprise message to the victim.

The files that get encrypted with the Tycoon ransomware end up with two extensions, that were not seen so far, “.grinch and .thanos.”

Initially, the security researchers at BlackBerry has detected the ransomware after a hacker attacked a network of a European educational institute. Here, the attacker accessed the network through an Internet-connected RDP jump server and deployed a persistent backdoor.

Here, the security experts justified that the hacker left the backdoor on the vulnerable servers, and then after seven days, the hacker again re-entered into the network of the institute through the back door.

Moreover, the security researchers point out that this form of attack is not common, since, in addition to being encoded in Java, the attackers use the Java image file (JIMAGE) located at lib\modules within the build directory to hide the malicious payload.

According to the security researchers, Tycoon ransomware is being deployed in an active ransomware attack campaign, using the highly targeted distribution mechanisms to infiltrate SMBs (small and medium-sized businesses), education institutions, and software industries, as here they can gain substantial amounts of money as ransom.

Protection and mitigation

To protect ourselves from this type of malware and ransomware, we should always have a backup of our most important files. It is imperative to keep our operating system and all the installed programs updated.

Apart from this, you have to keep installed a good antivirus for Windows or Linux, whatever the OS you are using. Not only that, but even you should also have to be careful while downloading any files from the internet by default, as most of them contain malware.

Here are the files extensions and signatures used by the attackers mentioned below.

Encrypted Files Extension:-

  • thanos
  • grinch
  • redrum

Encrypted Files Signature:-

  • happyny3.1
  • redrum3_0

So, what do you think about this? Share all your views and thoughts in the comment section below.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read:

Asigra Presents Five Preventative and Responsive Best Practices to Mitigate Ransomware Damages

REvil Ransomware 2.2 Released – Now Encrypts Open and Locked Files

Shade Ransomware Hackers Shutdown Their Operation – 750k Decryption Keys Released

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Nigerian National Extradited to Nebraska for Wire Fraud Charges

United States Attorney Susan Lehr announced the extradition of Abiola Kayode, 37, from Nigeria...

Dell Security Update, Patch for Multiple Critical Vulnerabilities

Dell Technologies has released a security advisory addressing multiple critical vulnerabilities that could expose...

CISA Issues 10 New Advisories on Industrial Control System Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has issued ten critical advisories, highlighting vulnerabilities...

FBI Seizes Rydox Marketplace, Arrests Key Administrators

The Federal Bureau of Investigation (FBI) announced the seizure of Rydox, an illicit online...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

PostgreSQL Vulnerability Allows Hackers To Execute Arbitrary SQL Functions

A critical vulnerability identified as CVE-2024-7348 has been discovered in PostgreSQL, enabling attackers to...

Security Risk Advisors Announces Launch of VECTR Enterprise Edition

Security Risk Advisors (SRA) announces the launch of VECTR Enterprise Edition, a premium version...

4 Leading Methods of Increasing Business Efficiency 

The more efficient your core business operations, the more motivated and productive your employees...