A new cross-platform ransomware named Luna can encrypt files on Windows, Linux, and ESXi, but its developers only offer it to Russian-speaking affiliates. The ransomware is fairly simple, according to researchers who analyzed the malware, but it uses an encryption scheme that is not typically used by ransomware a combination of X25519 elliptic curve Diffie-Hellman key exchange using Curve25519 with the Advanced Encryption Standard (AES) symmetric encryption algorithm. The Diffie-Hellman key exchange, also called an exponential key exchange, is a method of digital encryption that uses numbers raised to specific powers to produce decryption keys based on components that are never directly transmitted, making the task of a would-be code breaker mathematically overwhelming.
Luna, Russian for the moon, is developed in Rust, making it easy to port to different platforms and can also help evade static analysis. Luna further confirms the latest trend adopted by cybercrime gangs developing cross-platform ransomware that use languages like Rust and Golang to create malware capable of targeting multiple operating systems with little to no changes.
See: https://www.rust-lang.org/ and https://go.dev
Investigators have reported that the Linux and ESXi samples are compiled using the same source code with minor changes from the Windows version. For example, if the Linux samples are executed without command line arguments, they will not run. Instead, they will display available arguments that can be used. The rest of the code has no significant changes from the Windows version.
While many ransomware developers are prepared to allow people from all around the world to use their creativity to make a profit, cybercrime forum posts advertising Luna say the malware is only available to Russian-speaking affiliates. Based on this and the mistakes in the English-language ransom note, the researchers assume that Luna was developed by Russian speakers.
After Russia launched its invasion of Ukraine, several Russian cybercrime groups started targeting organizations located in countries that oppose Russia’s actions, and some groups even openly expressed support for their government. It is not surprising that a Russian group wants to only work with local cybercriminals.
In addition, it is becoming increasingly common for ransomware to target ESXi servers. In May 2022, Trend Micro reported seeing Cheerscrypt, Linux-based ransomware apparently based on leaked Babuk source code.
The Black Basta ransomware, which emerged earlier this year and has been linked to the Conti gang, has also targeted ESXi virtual machine images, as well as Linux systems. The recently emerged RedAlert ransomware has also targeted ESXi servers.
See: https://redskyalliance.org/xindustry/new-black-basta-ransomware
Other new ransomware families that have been recently reported include Lilith, C/C++ console-based ransomware targeting 64-bit Windows devices, and 0mega, a new ransomware operation targeting enterprises since May 2022 and demanding millions of dollars in ransoms. Both are known for stealing data from victims' networks before encrypting their systems to support their double-extortion attacks.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization that offers technical reports like this from our friends at Microsoft. For questions, comments, or assistance, please contact the office directly at 1-844-492-7225, or feedback@wapacklabs. com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www. redskyalliance. org/
- Website: https://www. wapacklabs. com/
- LinkedIn: https://www. linkedin. com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/5504229295967742989
Comments