RansomExx ransomware now targets also Linux systems

The RansomExx Ransomware gang is expanding its operations by creating a new version that is able to infect Linux machines.

RansomExx ransomware operators are expanding their operations by developing a Linux version of their malware.

Kaspersky researchers have analyzed the Linux version of the RansomExx ransomware, also tracked as Defray777.

This week the RansomExx ransomware has been involved in the attacks against Brazil’s Superior Court of Justice.

The RansomEXX is human-operated ransomware, this means that attackers manually infected the systems after gained access to the target network.

In June 2020, the same ransomware was employed in an attack on the Texas Department of Transportation, in August is infected systems at the multinational technology Konica Minolta, in September it infected the systems at the IPG Photonics high-performance laser developer and at the software provider Tyler Technologies.

The recently discovered Linux version of the RansomExx ransomware is built as an ELF executable named ‘svc-new’ that encrypts the target’s server.

“After the initial analysis we noticed similarities in the code of the Trojan, the text of the ransom notes and the general approach to extortion, which suggested that we had in fact encountered a Linux build of the previously known ransomware family RansomEXX,” reads the report published by Kaspersky.

Upon launching the Trojan, it generates a 256-bit key that is used to encrypt all the victim’s files that it can reach using the AES block cipher in ECB mode. The AES key is encrypted by a public RSA-4096 key embedded in the code of the malware and appended to all the encrypted file.

Experts pointed out that the ransomware lacks additional functionalities implemented by other Trojans, such as C2 communication, anti-analysis features, and the ability to kill processes.

Unlike the Windows version, the Linux variant doesn’t wipe free space.

Experts noticed that when a victim pays the ransom, they will receive both a Linux and Windows decryptor with the corresponding RSA-4096 private key and encrypted file extension embedded in the executable.

Despite the Windows and Linux variants have been built by different compilers with different optimization options and for different platforms, their similarity is clear:

Kaspersky’s report also includes Indicators of Compromise (IoCs) for the new variant.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, RansomExx ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]