A new piece of ransomware is spreading rapidly across China that has already infected more than 100,000 computers in the last four days as a result of a supply-chain attack… and the number of infected users is continuously increasing every hour.
What’s Interesting? Unlike almost every ransomware malware, the new virus doesn’t demand ransom payments in Bitcoin.
Instead, the attackers are asking victims to pay 110 yuan (nearly USD 16) in ransom through WeChat Pay—the payment feature offered by China’s most popular messaging app.
It also includes an additional ability to steal users’ account passwords for Alipay, NetEase 163 email service, Baidu Cloud Disk, Jingdong (JD.com), Taobao, Tmall , AliWangWang, and QQ websites.
A Supply Chain Attack — According to Chinese cybersecurity and anti-virus firm Velvet Security, attackers added malicious code into the “EasyLanguage” programming software used by a large number of application developers.
The maliciously modified programming software was designed to inject ransomware code into every application and software product compiled through it—another example of a software supply-chain attack to spread the virus rapidly.
More than 100,000 Chinese users who installed any of the above listed infected applications got their systems compromised. This ransomware encrypts all files on an infected system, except files with gif, exe, and tmp extensions.
Using Stolen Digital Signatures — To defend against Antivirus programs, attackers signed their malware code with a trusted digital signature from Tencent Technologies and avoid encrypting data in some specific directories, like “Tencent Games, League of Legends, tmp, rtl, and program.”
Once encrypted, the ransomware pops-up a note, asking users to pay 110 yuan to attackers’ WeChat account within 3 days to receive the decryption key.
If not paid within displayed time, the malware threatens to delete the decryption key from its remote command-and-control server automatically.
Besides encrypting user files, the ransomware also silently steals users login credential for popular Chinese websites and social media accounts and send them to a remote server.
It also gathers system information including CPU model, screen resolution, network information and list of installed software.
Poor Ransomware Has Been Cracked — Chinese cybersecurity researchers found that the ransomware has poorly been programmed and attackers lied about the encryption process.
The ransomware note says users’ files have been encrypted using DES encryption algorithm, but in reality, it encrypts data using a less secure XOR cipher and stores a copy of the decryption key locally on the victim’s system itself in a folder at following location:
Using this information, the Velvet security team created and released a free ransomware decryption tool that can easily unlock encrypted files for victims without requiring them to pay any ransom.
Researchers also managed to crack and access attackers’ command-and-control and MySQL database servers, and found thousands of stolen credentials stored on them.
Who Is Behind This Ransomware Attack? — Using publicly available information, researchers have found a suspect, named “Luo,” who is a software programmer by profession and developed applications like “lsy resource assistant” and “LSY classic alarm v1.1”
Lua’s QQ account number, mobile number, Alipay ID and email IDs match with the information researchers collected by following the attacker’s WeChat account.
After being notified of the threat, WeChat has also suspended the attackers account on its service that was being used to receive the ransom payments.
Velvet researchers have also informed Chinese law enforcement agencies with all available information for further investigation.