Linux ransomware: How to protect your business

QNAPCrypt

This attack focuses on Linux-based network-attached storage (NAS) devices. Distribution is typically through fake updates and infected files, including ZIP archives.

QNAPCrypt’s point of entry is flawed authentication of a SOCKS5 proxy (an alternative to a VPN that protects data packets during transfer) and has a low detection rate. Once a system is compromised, the malware requests a Bitcoin wallet and a public RSA key from the hacker’s server before encrypting the victim’s data.

Once encryption is complete, the ransom information is left in a .txt file. Each victim is given a unique Bitcoin wallet in which to pay the ransom, helping the attackers avoid detection.

RansomEXX

RansomEXX (también conocido como Defrat777) se ha convertido en una de las formas más comunes de ransomware en dispositivos Linux en los últimos años. Comenzó como un malware para Windows, pero se ha utilizado cada vez más para atacar servidores Linux, sobre todo contra el Gobierno brasileño, el Departamento de Transporte de Texas y el Hospital Universitario de Brno en la República Checa.

Este tipo de ransomware se conoce como un «cazador de grandes cantidades»: se suele utilizar para atacar a grandes organizaciones y gobiernos en un intento de conseguir grandes pagos de rescate. En lugar de atacar varios puntos finales, el malware se dirige directamente al servidor, restringiendo el acceso a los archivos en su origen, lo que convierte a los servidores Linux en el principal objetivo de este tipo de ataques.

El RansomEXX se suele entregar a través de un correo electrónico que contiene un documento de Word malicioso. Una vez abierto, se descarga un troyano en el sistema del usuario, cifrando los archivos y generando una clave de cifrado de 256 bits. La clave se vuelve a cifrar cada segundo.

Erebus

Erebus was first seen in 2016 as a Windows-based ransomware. It was used for the first time against Linux systems in 2017 for a high-profile attack on the South Korean web hosting company NAYANA. 153 Linux servers and more than 3,400 business websites were affected. The ransom of $1 million in Bitcoin set a record at the time for the highest fee paid.

Erebus relies on the user clicking on malicious links or opening infected emails attachments. It can also gain access to a system through malicious software, such as fake installers.

The ransomware scans for a wide range of file types to encrypt including databases, archives, and documents. The encryption process used is difficult to crack, as it uses a blend of three different cryptosystems (RSA-2048, AES and RC4). The ransomware also deletes Shadow Volume Copies of the operating system, making recovery even harder.

KillDisk

KillDisk is another ransomware that began on Windows before being adapted to Linux. The Linux version of KillDisk encrypts each file with a different set of 64-bit encryption keys. It then prevents the system from booting by overwriting the bootloader, instead presenting the user with a full-screen ransom note demanding payment in Bitcoin.

The Linux version of KillDisk then varies from Windows: The keys required to decrypt the data are not stored locally or sent to a server during a Linux attack, meaning that the encryption tool was most likely written to be destructive rather than for extortion. If no encryption key exists, the files are unlikely to ever be recovered, regardless of whether the ransom is paid.