Cicada3301 ransomware’s Linux encryptor targets VMware ESXi programs

A brand novel ransomware-as-a-provider (RaaS) operation is impersonating the legit Cicada 3301 group and has already listed 19 victims on its extortion portal, because it snappy attacked firms worldwide.

The novel cybercrime operation is named after and makes use of the a similar model because the mysterious 2012-2014 online/exact-world game named Cicada 3301 that alive to account for cryptographic puzzles.

On the opposite hand, there could be no connection between the 2, and the legit project has issued a statement to give up any affiliation with the possibility actors and condemned the ransomware operation’s actions.

“We discontinue no longer know the identification of the criminals at the abet of those defective crimes, and are no longer associated with these groups in any approach,” reads the statement from the Cicada 3301 group.

Top private investigator: Launched in early June

The Cicada3301 RaaS first began promoting the operation and recruiting affiliates on June 29, 2024, in a forum undergo the ransomware and cybercrime forum identified as RAMP.

On the opposite hand, BleepingComputer is responsive to Cicada assaults as early as June 6, indicating that the crew used to be working independently earlier than trying to recruit affiliates.

Relish assorted ransomware operations, Cicada3301 conducts double-extortion tactics the put they breach corporate networks, steal details, and then encrypt devices. The encryption key and threats to leak stolen details are then usual as leverage to fear victims into paying a ransom.

The possibility actors operate an details leak put that is common as portion of their double-extortion blueprint.

An prognosis of the novel malware by Truesec published well-known overlaps between Cicada3301 and ALPHV/BlackCat, indicating a that it’s good to perchance perchance well be in a put to deem rebrand or a fork created by dilapidated ALPHV’s core team contributors.

Right here is primarily based completely mostly on the truth that: 

• Both are written in Rust.
• Both Exercise the ChaCha20 algorithm for encryption.
• Both make use of a similar VM shutdown and snapshot-wiping instructions.
• Both use the a similar person interface suppose parameters, the a similar file naming conference, and the a similar ransom designate decryption system.
• Both use intermittent encryption on better files.

For context, ALPHV carried out an exit scam in early March 2024 keen faux claims about an FBI takedown operation after they stole a massive $22 million price from Substitute Healthcare from one in all their affiliates.

Truesec has also learned indications that the Cicada3301 ransomware operation can also associate with or form primarily the most of the Brutus botnet for preliminary entry to corporate networks. That botnet used to be previously associated with global-scale VPN brute-forcing actions targeting Cisco, Fortinet, Palo Alto, and SonicWall home equipment.

Or no longer it is value noting that the Brutus exercise used to be first spotted two weeks after ALPHV shut down operations, so the link between the 2 groups restful stands in phrases of timelines.

Top private investigator: But one other possibility to VMware ESXi

Cicada3301 is a Rust-primarily based completely mostly ransomware operation with both Home windows and Linux/VMware ESXi encryptors. As portion of Truesec’s document, the researchers analyzed the VMWare ESXi Linux encryptor for the ransomware operation.

Relish BlackCat and various ransomware households, comparable to RansomHub, a clear key desires to be entered as a suppose line argument to launch the encryptor. This key is common to decrypt an encrypted JSON blob that contains the configuration that the encryptor will use when encrypting a instrument.

Truesec says that the encryptor tests for the validity of the main by utilizing it to decrypt the ransom designate and, if worthwhile, continues with the the rest of the encryption operation.

Its main feature (linux_enc) makes use of the ChaCha20 circulation cipher for file encryption and then encrypts the symmetric key usual within the approach with an RSA key. The encryption keys are generated randomly utilizing the ‘OsRng’ feature.

Cicada3301 targets relate file extensions matching paperwork and media files and tests their dimension to rep out the put to use intermittent encryption (>100MB) and the put to encrypt the total file contents (<100MB).

When encrypting files, the encryptor will append a random seven-character extension to the file title and earn ransom notes named ‘RECOVER-[extension]-DATA.txt,’ as proven below. It could perchance probably also restful be eminent that BlackCat/ALPHV encryptors also usual random seven-character extensions and a ransom designate named ‘RECOVER-[extension]-FILES.txt.’

The ransomware’s operators can region a snooze parameter to lengthen the encryptor’s execution, potentially to evade rapid detection.

A “no_vm_ss” parameter also orders the malware to encrypt VMware ESXi virtual machines without trying to shut them down first.

On the opposite hand, by default, Cicada3301 first makes use of ESXi’s ‘esxcli’ and ‘vim-cmd’ instructions to shut down virtual machines and delete their snapshots earlier than encrypting details.

esxcli –formatter=csv –format-param=fields==”WorldID,DisplayName” vm process list | grep -viE ”,(),” | awk -F ”\”*,\”*” '{system(”esxcli vm process kill –type=force –world-id=”$1)}’ > /dev/null 2>&1;

for i in `vim-cmd vmsvc/getallvms| awk '{print$1}’`;do vim-cmd vmsvc/snapshot.removeall $i & done > /dev/null 2>&1

Cicada3301’s actions and rate of success repeat an experienced actor who’s aware of what they’re doing, further supporting the speculation of an ALPHV reboot or at least utilizing affiliates with prior ransomware ride.

The novel ransomware’s focal level on ESXi environments highlights its strategic form to maximize anguish in enterprise environments that many possibility actors now target for lucrative earnings.

By combining file encryption being able to disrupt VM operations and steal away restoration alternate suggestions, Cicada3301 ensures a high-affect attack that is affecting whole networks and infrastructures, maximizing the stress placed on victims.