- Oct 30, 2015
- 1,251
Keys to Chimera crypto ransomware allegedly leaked by rival crime gang
First, Mischa devs stole their rival's code. Now, they may have killed its business.
Dan Goodin - 7/27/2016, 4:51 AM
Sometimes, the fierce competition in the booming crypto ransomware market works in the favor of the victims whose priceless data is held hostage. That appears to be what played out on Tuesday when the criminals behind a package known as "Mischa" published what's purported to be the secret crypto keys for the rival Chimera malware.
"Earlier this year we got access to big parts of their deveolpment [sic] system, and included parts of Chimera in our project," the Mischa developers wrote in a message posted to Pastebin. "Additionally we now release about 3500 decryption keys from Chimera."
Translation: As if breaking in to the Chimera developers' network and stealing their code wasn't enough of an affront, the competing Mischa gang now claims to have leaked the keys that defang Chimera.
As researchers from antivirus provider Malwarebytes documented in December, Chimera not only encrypts user data, it also threatens to publish the data in plaintext in the event that the victim fails to pay the ransom. There's no evidence that the Chimera actors have followed through, but the threat is a sinisterly clever way of turning up the pressure on victims who may be tempted to not pay and simply walk away from their photos, e-mails, and other encrypted data. In a separate post, the Malwarebytes researchers also confirmed that Mischa contained core parts of Chimera's code.
Should they turn out to be authentic, the RSA keys will be a lifesaver to people whose data has been held in limbo by Chimera. But then again, it would do nothing to help victims of Mischa (which is bundled with a separate piece of crypto ransomware known as Petya). In fact, Mischa/Petya victims have reason to curse the Chimera group given that parts of its code were appropriated and used in the rival package.
"Checking if the keys are authentic and writing a decryptor will take some time," Malwarebytes researchers—who first flagged the Pastebin post—wrote in a blog post. "But if you are a victim of Chimera, please don’t delete your encrypted files, because there is a hope that soon you can get your data back."
First, Mischa devs stole their rival's code. Now, they may have killed its business.
Dan Goodin - 7/27/2016, 4:51 AM
Sometimes, the fierce competition in the booming crypto ransomware market works in the favor of the victims whose priceless data is held hostage. That appears to be what played out on Tuesday when the criminals behind a package known as "Mischa" published what's purported to be the secret crypto keys for the rival Chimera malware.
"Earlier this year we got access to big parts of their deveolpment [sic] system, and included parts of Chimera in our project," the Mischa developers wrote in a message posted to Pastebin. "Additionally we now release about 3500 decryption keys from Chimera."
Translation: As if breaking in to the Chimera developers' network and stealing their code wasn't enough of an affront, the competing Mischa gang now claims to have leaked the keys that defang Chimera.
As researchers from antivirus provider Malwarebytes documented in December, Chimera not only encrypts user data, it also threatens to publish the data in plaintext in the event that the victim fails to pay the ransom. There's no evidence that the Chimera actors have followed through, but the threat is a sinisterly clever way of turning up the pressure on victims who may be tempted to not pay and simply walk away from their photos, e-mails, and other encrypted data. In a separate post, the Malwarebytes researchers also confirmed that Mischa contained core parts of Chimera's code.
Should they turn out to be authentic, the RSA keys will be a lifesaver to people whose data has been held in limbo by Chimera. But then again, it would do nothing to help victims of Mischa (which is bundled with a separate piece of crypto ransomware known as Petya). In fact, Mischa/Petya victims have reason to curse the Chimera group given that parts of its code were appropriated and used in the rival package.
"Checking if the keys are authentic and writing a decryptor will take some time," Malwarebytes researchers—who first flagged the Pastebin post—wrote in a blog post. "But if you are a victim of Chimera, please don’t delete your encrypted files, because there is a hope that soon you can get your data back."
![[correlate]](/data/avatars/s/79/79653.jpg?1556985072){kind=avatar}