Linux ransomware: How to protect your business

QNAPCrypt

This attack focuses on Linux-based network-attached storage (NAS) devices. Distribution is typically through fake updates and infected files, including ZIP archives.

QNAPCrypt’s point of entry is flawed authentication of a SOCKS5 proxy (an alternative to a VPN that protects data packets during transfer) and has a low detection rate. Once a system is compromised, the malware requests a Bitcoin wallet and a public RSA key from the hacker’s server before encrypting the victim’s data.

Once encryption is complete, the ransom information is left in a .txt file. Each victim is given a unique Bitcoin wallet in which to pay the ransom, helping the attackers avoid detection.

RansomEXX

RansomEXX (též Defrat777) se v posledních letech stal jednou z nejběžnějších forem ransomwaru na zařízeních s Linuxem. Původně šlo o malware pro Windows, který se postupně začal používat k útokům na linuxové servery. Mezi nejznámější patří útoky na brazilskou státní správu, ministerstvo dopravy v Texasu a Fakultní nemocnici Brno v České republice.

Tento typ ransomwaru se snaží ulovit „velké hráče“ – obvykle cílí na rozsáhlé organizace a státní správu, aby mohl požadovat vysoké výkupné. Tento malware neútočí na koncová zařízení, ale zaměřuje se přímo na server, čímž omezí přístup k souborům přímo v jejich zdroji. Primárním cílem tohoto typu útoku jsou proto linuxové servery.

RansomEXX se obvykle šíří přes e-mail obsahující škodlivý dokument aplikace Word. Po jeho otevření si uživatel stáhne do systému trojského koně, který zašifruje soubory a vygeneruje 256bitový šifrovací klíč. Tento klíč je následně každou sekundu znovu zašifrován.

Erebus

Erebus was first seen in 2016 as a Windows-based ransomware. It was used for the first time against Linux systems in 2017 for a high-profile attack on the South Korean web hosting company NAYANA. 153 Linux servers and more than 3,400 business websites were affected. The ransom of $1 million in Bitcoin set a record at the time for the highest fee paid.

Erebus relies on the user clicking on malicious links or opening infected emails attachments. It can also gain access to a system through malicious software, such as fake installers.

The ransomware scans for a wide range of file types to encrypt including databases, archives, and documents. The encryption process used is difficult to crack, as it uses a blend of three different cryptosystems (RSA-2048, AES and RC4). The ransomware also deletes Shadow Volume Copies of the operating system, making recovery even harder.

KillDisk

KillDisk is another ransomware that began on Windows before being adapted to Linux. The Linux version of KillDisk encrypts each file with a different set of 64-bit encryption keys. It then prevents the system from booting by overwriting the bootloader, instead presenting the user with a full-screen ransom note demanding payment in Bitcoin.

The Linux version of KillDisk then varies from Windows: The keys required to decrypt the data are not stored locally or sent to a server during a Linux attack, meaning that the encryption tool was most likely written to be destructive rather than for extortion. If no encryption key exists, the files are unlikely to ever be recovered, regardless of whether the ransom is paid.