Cryptnet Ransomware

Description Summary

According to OALabs, this ransomware has the following features: * Files are encrypted with AES CBC using a generated 256 bit key and IV. * The generated AES keys are encrypted using a hard coded RSA key and appended to the encrypted files.

Threat Actor

RaaS; .NET payload obfuscated with .NET Reactor.

Technical Indicators

Encryption Extension
.<random 5-char>
Encryption Algorithm
AES-256 (CBC) + RSA (hardcoded public key)
Ransom Note Name
RESTORE-FILES-[ext].txt
Targeted Industries
Cross-sector
First Seen
April 2023
Last Seen
Active
Geographical Location
Worldwide

MITRE ATT&CK Matrix

Tactic TTP Technique Name
Impact x 2 T1486 Data Encrypted for Impact
T1490 Inhibit System Recovery
Exfiltration x 1 T1567 Exfiltration Over Web Service (leak site)
Initial Access x 2 T1190 Exploit Public-Facing Application
T1078 Valid Accounts