A newly-discovered strain of ransomware is using Java to target Windows and Linux PCs belonging to software and education-focused organisations.
The malware, named Tycoon, was uncovered and analysed by BlackBerry’s Research and Intelligence and KPMG’s UK Cyber Response Services teams. Their researchers believe that the malware has been active since December 2019, yet was able to “fly under the radar” due to using “an obscure Java image format”.
Tycoon is known to be deployed as a trojanised Java Runtime Environment, being compiled in a Java image file (Jimage) in order to conceal its malicious intent. The malware is spread by connecting to a system using a remote desktop protocol (RDP) server.
KPMG’s and BlackBerry’s researchers explained that “the threat actors behind Tycoon were observed using highly targeted delivery mechanisms to infiltrate small to medium-sized companies and institutions in education and software industries, where they would proceed to encrypt file servers and demand a ransom,” which is paid in bitcoins.
However, the researchers claim that because of the reuse of a fairly common RSA private key, it may be possible to recover encrypted data without having to pay.
Tycoon uses encrypted files extension such as “thanos”, “grinch”, and “redrum”, and its encrypted files signatures include “happyny3.1” and “redrum3_0”.
Although KPMG and BlackBerry’s teams are familiar with “a substantial increase in ransomware written in languages such as Java and Go”, they said that Tycoon “is the first sample we've encountered that specifically abuses the Java JIMAGE format to create a custom malicious JRE build”.
RELATED RESOURCE
How enterprises are embracing cyber security challenges
Enterprises across Europe, the Middle East and Africa are undergoing a significant transformation
“Malware writers are constantly seeking new ways of flying under the radar,” they explained. “They are slowly moving away from conventional obfuscation and shifting towards uncommon programming languages and obscure data formats.”
It has not been revealed how many organisations had fallen victim to the Tycoon malware. The number is believed to be limited as hackers appear to be choosing their targets carefully.
-
US Senator calls for Microsoft to be investigated over ‘gross cybersecurity negligence’News Ron Wyden, a Democratic senator from Oregon, has written to the chair of the FTC calling for an investigation into Microsoft's cyber practices.
-
LNER warns customers to remain vigilant after personal data exposed in cyber attackNews LNER has warned customers to remain vigilant for social engineering attacks after a cyber attack on the rail operator exposed personal data.
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
