Friday, October 11, 2024
HomeUncategorizedTycoon Ransomware - New Java Based Ransomware Attack Windows & Linux...

Tycoon Ransomware – New Java Based Ransomware Attack Windows & Linux Users

Published on

Security experts have warned that hackers are using a new multi-platform Java ransomware “Tycoon” to target Windows and Linux users to lock down the files.

We all know that hackers are constantly looking for new means to attack data centers and systems of normal users to steal essential data and information.

Since Microsoft Windows is the most used OS, that’s why hackers are making it as their target. hackers are paying more and more attention to other operating systems as well, like macOS and Linux. 

- Advertisement - EHA

As hackers are betting massively on multi-platform malware and ransomware, that affects all the major platforms. The main goal of this critical vulnerability is to infect the SMBs in the software and education industries.

Tycoon Ransomware

Security experts at BlackBerry Research and Intelligence Team in association with KPMG’s UK Cyber ​​Response Services have named this ransomware as “Tycoon,” and it has been in operation since the end of 2019.

Here the main feature of Tycoon Ransomware is infecting all Windows and Linux users equally since it is a ransomware that is written in Java programming language.

Hackers hide the Tycoon inside a modified ZIP file that executes the trojan when the victim opens it. They commonly use the RDP server and vulnerable networks to sneak into the systems.

Once the hacker managed to run the ransomware on the victim’s system, it starts gaining persistence on the system, and to do this, it performs an IFEO (Image file execution options) injection in the Windows on-screen keyboard function.

It also changes the Active Directory password as well and disables the antivirus and then installs the ProcessHacker hacker-as-a-service utility tool.

After completing all these steps, the ransomware begins to encrypt all the data present on the computer and on the network drives.

Once everything is done, it automatically sends the private key to the hacker securely, then it destroys the private key from the victim’s system, and finally, it displays the surprise message to the victim.

The files that get encrypted with the Tycoon ransomware end up with two extensions, that were not seen so far, “.grinch and .thanos.”

Initially, the security researchers at BlackBerry has detected the ransomware after a hacker attacked a network of a European educational institute. Here, the attacker accessed the network through an Internet-connected RDP jump server and deployed a persistent backdoor.

Here, the security experts justified that the hacker left the backdoor on the vulnerable servers, and then after seven days, the hacker again re-entered into the network of the institute through the back door.

Moreover, the security researchers point out that this form of attack is not common, since, in addition to being encoded in Java, the attackers use the Java image file (JIMAGE) located at lib\modules within the build directory to hide the malicious payload.

According to the security researchers, Tycoon ransomware is being deployed in an active ransomware attack campaign, using the highly targeted distribution mechanisms to infiltrate SMBs (small and medium-sized businesses), education institutions, and software industries, as here they can gain substantial amounts of money as ransom.

Protection and mitigation

To protect ourselves from this type of malware and ransomware, we should always have a backup of our most important files. It is imperative to keep our operating system and all the installed programs updated.

Apart from this, you have to keep installed a good antivirus for Windows or Linux, whatever the OS you are using. Not only that, but even you should also have to be careful while downloading any files from the internet by default, as most of them contain malware.

Here are the files extensions and signatures used by the attackers mentioned below.

Encrypted Files Extension:-

  • thanos
  • grinch
  • redrum

Encrypted Files Signature:-

  • happyny3.1
  • redrum3_0

So, what do you think about this? Share all your views and thoughts in the comment section below.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read:

Asigra Presents Five Preventative and Responsive Best Practices to Mitigate Ransomware Damages

REvil Ransomware 2.2 Released – Now Encrypts Open and Locked Files

Shade Ransomware Hackers Shutdown Their Operation – 750k Decryption Keys Released

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Mozilla Warns Of Firefox Zero-Day Actively Exploited In Cyber Attacks

A critical use-after-free vulnerability affecting Firefox and Firefox Extended Support Release (ESR) is being...

SpyCloud Embeds Identity Analytics in Cybercrime Investigations Solution to Accelerate Insider and Supply Chain Risk Analysis & Threat Actor Attribution

IDLink, SpyCloud’s new automated digital identity correlation capability, is now core to its industry-leading...

Abusix and Red Sift Form New Partnership, Leveraging Automation to Mitigate Cyber Attacks

The agreement has marked over 600,000 fraudulent domains for takedown in just two months...

Hackers Exploiting Zero-day Flaw in Qualcomm Chips to Attack Android Users

Hackers exploit a zero-day vulnerability found in Qualcomm chipsets, potentially affecting millions worldwide.The flaw,...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

PostgreSQL Vulnerability Allows Hackers To Execute Arbitrary SQL Functions

A critical vulnerability identified as CVE-2024-7348 has been discovered in PostgreSQL, enabling attackers to...

Security Risk Advisors Announces Launch of VECTR Enterprise Edition

Security Risk Advisors (SRA) announces the launch of VECTR Enterprise Edition, a premium version...

4 Leading Methods of Increasing Business Efficiency 

The more efficient your core business operations, the more motivated and productive your employees...