Tycoon Ransomware – New Java Based Ransomware Attack Windows & Linux Users

Security experts have warned that hackers are using a new multi-platform Java ransomware “Tycoon” to target Windows and Linux users to lock down the files.

We all know that hackers are constantly looking for new means to attack data centers and systems of normal users to steal essential data and information.

Since Microsoft Windows is the most used OS, that’s why hackers are making it as their target. hackers are paying more and more attention to other operating systems as well, like macOS and Linux. 

As hackers are betting massively on multi-platform malware and ransomware, that affects all the major platforms. The main goal of this critical vulnerability is to infect the SMBs in the software and education industries.

Tycoon Ransomware

Security experts at BlackBerry Research and Intelligence Team in association with KPMG’s UK Cyber ​​Response Services have named this ransomware as “Tycoon,” and it has been in operation since the end of 2019.

Here the main feature of Tycoon Ransomware is infecting all Windows and Linux users equally since it is a ransomware that is written in Java programming language.

Hackers hide the Tycoon inside a modified ZIP file that executes the trojan when the victim opens it. They commonly use the RDP server and vulnerable networks to sneak into the systems.

Once the hacker managed to run the ransomware on the victim’s system, it starts gaining persistence on the system, and to do this, it performs an IFEO (Image file execution options) injection in the Windows on-screen keyboard function.

It also changes the Active Directory password as well and disables the antivirus and then installs the ProcessHacker hacker-as-a-service utility tool.

After completing all these steps, the ransomware begins to encrypt all the data present on the computer and on the network drives.

Once everything is done, it automatically sends the private key to the hacker securely, then it destroys the private key from the victim’s system, and finally, it displays the surprise message to the victim.

The files that get encrypted with the Tycoon ransomware end up with two extensions, that were not seen so far, “.grinch and .thanos.”

Initially, the security researchers at BlackBerry has detected the ransomware after a hacker attacked a network of a European educational institute. Here, the attacker accessed the network through an Internet-connected RDP jump server and deployed a persistent backdoor.

Here, the security experts justified that the hacker left the backdoor on the vulnerable servers, and then after seven days, the hacker again re-entered into the network of the institute through the back door.

Moreover, the security researchers point out that this form of attack is not common, since, in addition to being encoded in Java, the attackers use the Java image file (JIMAGE) located at lib\modules within the build directory to hide the malicious payload.

According to the security researchers, Tycoon ransomware is being deployed in an active ransomware attack campaign, using the highly targeted distribution mechanisms to infiltrate SMBs (small and medium-sized businesses), education institutions, and software industries, as here they can gain substantial amounts of money as ransom.

Protection and mitigation

To protect ourselves from this type of malware and ransomware, we should always have a backup of our most important files. It is imperative to keep our operating system and all the installed programs updated.

Apart from this, you have to keep installed a good antivirus for Windows or Linux, whatever the OS you are using. Not only that, but even you should also have to be careful while downloading any files from the internet by default, as most of them contain malware.

Here are the files extensions and signatures used by the attackers mentioned below.

Encrypted Files Extension:-

• thanos
• grinch
• redrum

Encrypted Files Signature:-

• happyny3.1
• redrum3_0

So, what do you think about this? Share all your views and thoughts in the comment section below.