This rather odd ransomware deletes your data just a few bytes at a time
Data wiper replaces every other 666 bytes of data with junk
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A new data-wiping malware has been detected, infecting more and more endpoints with each passing day - but what’s most curious is that it poses asransomware.
The malware is called Azov Ransomware, and when run on a victim’s device, it overwrites file data with junk, rendering the files useless. The overwrites are cyclical - the malware would overwrite 666 bytes of data, then leave the next 666 intact, then repeat the process.
Even though there is no way to retrieve the corrupt files, there is no decryption key or ransom demands, themalwarestill comes with a ransom note, which says that victims should reach out to security researchers and journalists for help.
Execution trigger
Another curious thing about Azov Ransomware is that it comes with a trigger, having it sit idly on the endpoint until October 27, 10:14:30 AM UTC, after which all hell breaks loose.
When this date comes, the victim doesn’t necessarily need to run the exact executable - running pretty much any program will do. That’s because the wiper will infect all other 64-bit executables on the devices whose file path does not hold these strings:
These are the best antivirus programs out there>Ransomware posing as Windows antivirus update will just empty your wallet>What is ransomware and how does it work?
:\Windows\ProgramData\cache2\entries\Low\Content.IE5\User Data\Default\Cache\Documents and Settings\All Users,
In other words, running a seemingly benign program would crash the computer and ruin all of the data on it.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Azov Ransomware is being distributed through the Smokeloader botnet, which is commonly found in fake pirated software and crack sites.
Whoever is behind this wiper, their motives remain unclear. While some researchers think the wiper is used as a cover-up for other malicious behavior, others think the motive is nothing more than to troll the cybersecurity community.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Lego will let you build Sir Ernest Shackleton’s iconic lost ship, the Endurance, in its next Icons set
