New Ransomware: Pay Up Or Files Go Public

A new form of ransomware named after a Marvel super villain has some particularly evil features. The Thanos malware uses an approach more reminiscent of "physical world" blackmail.

Despite the name, the malware thankfully doesn't imitate the character Thanos by - spoiler alert - deleting half the files in the entire universe.

That said, it's still quite scary thanks to a couple of features beyond the usual tactic of encrypting files and demanding a ransom. Instead, the ransomware also seeks to spread across an entire local network and encrypt all the computers it can reach.

This is especially bad news for any business or organization that is currently relying on remote desktop connections in order to access data at an office due to the COVID-19 pandemic, for example. Such machines are incredibly at risk of ransomware sneaking onto the network, particularly if the remote desktop protocol becomes exploitable. In this case, ransomware can sneak onto a network despite security updates, firewall, or antivirus installed.

Personal Data Shared Online

That said, the Thanos ransomware has a tactic aimed at individuals. Before encrypting files, Thanos copies anything in a common document format such as Microsoft Word and Excel files and Adobe PDF documents and holds on to these copies remotely.

The victim then gets a ransom demand with the threat that not only will their own copies of the files remain locked, but the stolen copies will be published online unless they pay a ransom. The demand says the files will appear on sites dedicated to data leaks, meaning there's a strong likelihood that professional scammers will try to exploit any personal data in the documents.

Security Software Fooled

To make things worse, Thanos uses a new technique called RIPlace that aims to disguise the manipulation of files to avoid detection by security software that specifically looks for ransomware.

That's a big worry as when RIPlace first became public knowledge, several security software firms said they didn't need to update their tools as it was a purely theoretical threat. (Source: bleepingcomputer.com)

That is no longer the case, however, as it appears Thanos has a good chance of spreading. Digital criminals have been offered a hefty revenue share of any ransom payments in return for helping get it on to more machines.

They also get access to a tool that can customize Thanos to as many as 43 different versions, making it much harder to detect. (Source: itwire.com)

What's Your Opinion?

Would you pay a ransom to stop files on your computer being published? Would their content cause you problems if scammers could access them? Are you confident your chosen security tools do enough to combat ransomware?