IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Tycoon ransomware discovered using Java image files to target software firms

Researchers believe that the malware has been active since December 2019

A newly-discovered strain of ransomware is using Java to target Windows and Linux PCs belonging to software and education-focused organisations.

The malware, named Tycoon, was uncovered and analysed by BlackBerry’s Research and Intelligence and KPMG’s UK Cyber Response Services teams. Their researchers believe that the malware has been active since December 2019, yet was able to “fly under the radar” due to using “an obscure Java image format”.

Tycoon is known to be deployed as a trojanised Java Runtime Environment, being compiled in a Java image file (Jimage) in order to conceal its malicious intent. The malware is spread by connecting to a system using a remote desktop protocol (RDP) server.

KPMG’s and BlackBerry’s researchers explained that “the threat actors behind Tycoon were observed using highly targeted delivery mechanisms to infiltrate small to medium-sized companies and institutions in education and software industries, where they would proceed to encrypt file servers and demand a ransom,” which is paid in bitcoins.

However, the researchers claim that because of the reuse of a fairly common RSA private key, it may be possible to recover encrypted data without having to pay.

Tycoon uses encrypted files extension such as “thanos”, “grinch”, and “redrum”, and its encrypted files signatures include “happyny3.1” and “redrum3_0”.

Although KPMG and BlackBerry’s teams are familiar with “a substantial increase in ransomware written in languages such as Java and Go”, they said that Tycoon “is the first sample we've encountered that specifically abuses the Java JIMAGE format to create a custom malicious JRE build”.

Related Resource

How enterprises are embracing cyber security challenges

Enterprises across Europe, the Middle East and Africa are undergoing a significant transformation

Download now

“Malware writers are constantly seeking new ways of flying under the radar,” they explained. “They are slowly moving away from conventional obfuscation and shifting towards uncommon programming languages and obscure data formats.”

It has not been revealed how many organisations had fallen victim to the Tycoon malware. The number is believed to be limited as hackers appear to be choosing their targets carefully.

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
US government warns of increased risk of ransomware over holiday season
ransomware

US government warns of increased risk of ransomware over holiday season

24 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Europe's first autonomous petrol station opens in Lisbon
automation

Europe's first autonomous petrol station opens in Lisbon

23 May 2022
Linux-based Cheerscrypt ransomware found targeting VMware ESXi servers
ransomware

Linux-based Cheerscrypt ransomware found targeting VMware ESXi servers

26 May 2022