New White Rabbit ransomware linked to FIN8 hacking group


Level 63
Thread author
Honorary Member
Top poster
Content Creator
Apr 24, 2016
A new ransomware family called 'White Rabbit' appeared in the wild recently, and according to recent research findings, could be a side-operation of the FIN8 hacking group.

FIN8 is a financially motivated actor who has been spotted targeting financial organizations for several years, primarily by deploying POS malware that can steal credit card details. In a new report by Trend Micro, researchers analyze a sample of the White Rabbit ransomware obtained during an attack on a US bank in December 2021. The ransomware executable is a small payload, weighing in at 100 KB file, and requires a password to be entered on command line execution to decrypt the malicious payload. A password to execute the malicious payload has been used previously by other ransomware operations, including Egregor, MegaCortex, and SamSam.

Once executed with the correct password, the ransomware will scan all folders on the device and encrypt targeted files, creating ransom notes for each file it encrypts. For example, a file named test.txt would be encrypted as test.txt.scrypt, and a ransom note would be created named test.txt.scrypt.txt. While encrypting a device, removable and network drives are also targeted, with Windows system folders excluded from encryption to prevent rendering the operating system unusable. The ransom note informs the victim that their files had been exfiltrated and threatens to publish and/or sell the stolen data if the demands are not met.
Last edited by a moderator: