ClickCease New ransomware tool uses unique tactics to corrupt data

Join Our Popular Newsletter

Join 4,500+ Linux & Open Source Professionals!

2x a month. No spam.

New ransomware tool uses unique tactics to corrupt data

Obanla Opeyemi

October 6, 2022 - TuxCare expert team

Threat actors are now updating the data exfiltration tool Exmatter with a unique data corruption feature, which attackers could switch to perform ransomware attacks in the future.

The new unique data corruption feature was discovered by malware analysts working with Cyderes Special Operations Team during a recent incident response.

Basically, this tactic involves the use of data from an exfiltrated file to damage another file. Security researchers believe that it is an attempt to bypass ransomware or wiper heuristic-based detection, which could be triggered if randomly generated data are used.

“As files upload to the actor-controlled server, the files that have been successfully copied to the remote server are queued to be processed by a class named Eraser. A randomly sized segment starting at the beginning of the second file is read into a buffer and then written into the beginning of the first file, overwriting it and corrupting the file,”

Researchers believe that the new tool will change the strategy that is used by ransomware affiliates. Ransomware operations have been running for a long time as Ransomware-as-a-Service, which means that operators/developers are responsible for developing the ransomware, payment site, and handling negotiations, while affiliates join to break corporate networks, steal data, delete backups and encrypt devices.

However, the structure puts affiliates at a disadvantage. Ransomware operations introduce bugs that allow security researchers to create decryptors that can help victims to recover files for free.

Although payment agreement means that the ransomware operators receive between 15-30%, while affiliates receive the rest, the affiliates lose in cases where security researchers create a decryptor, all potential revenue, which they would have received as part of a ransom payment.

With the new data corruption feature, however, a shift could arise from traditional ransomware attacks, in which data is stolen and then encrypted, to attacks, in which data is stolen and then deleted or damaged.

The method allows affiliates to keep all revenue from an attack since they do not have to share a percentage with the encryption developer.

The sources for this piece include an article in BleepingComputer.

Summary
New ransomware tool uses unique tactics to corrupt data
Article Name
New ransomware tool uses unique tactics to corrupt data
Description
Threat actors are now updating the data exfiltration tool Exmatter with a unique data corruption feature that enables data destruction.
Author
Publisher Name
Tuxcare
Publisher Logo

Looking to automate vulnerability patching without kernel reboots, system downtime, or scheduled maintenance windows?

Learn About Live Patching with TuxCare

Related Articles

How GPT models can be...

According to CyberArk researchers, GPT-based models like ChatGPT can be...

January 30, 2023

Attackers actively exploit Unpatched Control...

Malicious hackers have started exploiting a critical vulnerability CVE-2022-44877 in...

January 27, 2023

Attackers distribute malware via malicious...

Deep Instinct researchers reported that RATs like StrRAT and Ratty...

January 26, 2023

CircleCI partners AWS to identify...

According to CircleCI’s CTO, Rob Zuber, CircleCI is working with...

January 25, 2023

Cisco warns of authentication bypass...

A remote attacker could exploit multiple vulnerabilities in four Cisco...

January 24, 2023

IceID malware infiltrates Active Directory...

In a notable IcedID malware attack, the assailant impacted the...

January 23, 2023