HelloXD Ransomware Bulked Up with Better Encryption, Nastier Payload

[upnorth]

Content source

https://www.theregister.com/2022/06/13/helloxd-ransomware-evolving/

Windows and Linux systems are coming under attack by new variants of the HelloXD ransomware that includes stronger encryption, improved obfuscation and an additional payload that enables threat groups to modify compromised systems, exfiltrate files and execute commands.

The new capabilities make the ransomware, first detected in November 2021 - and the developer behind it even more dangerous - according to researchers with Palo Alto Networks' Unit 42 threat intelligence group. Unit 42 said the HelloXD ransomware family is in its initial stages but it's working to track down the author. "While the ransomware functionality is nothing new, during our research, following the lines, we found out the ransomware is most likely developed by a threat actor named x4k," the researchers wrote in a blog post.

"This threat actor is well known on various hacking forums, and seems to be of Russian origin. Unit 42 was able to uncover additional x4k activity being linked to malicious infrastructure, and additional malware besides the initial ransomware sample, going back to 2020."

The ransomware family is based on the Babuk (or Babyk) source code that was leaked on a Russian-language forum in September 2021. The group runs double extortion campaigns, exfiltrating the corporate data before encrypting it. Rather than threatening to release the files on a public leak site if the ransom isn't paid, the attackers instead directs victims to negotiate via the aTox chat service.

The most significant change between the two version was the introduction of the additional payload within version 2 that is a variant of the open-source MicroBackdoor and is encrypted with the WinCrypt API. The malware enables an attack to browse through the compromised file system, upload and download files and remote code execution (RCE). The malware also can remove itself from the system. The fact that the backdoor is delivered with the ransomware also is unusual.

HelloXD ransomware bulked up with improved encryption

Russian-based group doubles the extortion by exfiltrating the corporate data before encrypting it.

www.theregister.com