Wormhole Ransomware Locks Victims' Files
In our investigation of the Wormhole malware, we determined that it functions as ransomware with the primary objective of encrypting files and demanding ransom for decryption. Alongside encrypting files, Wormhole alters filenames by appending the extension ".Wormhole" (e.g., renaming "1.jpg" to "1.jpg.Wormhole", "2.png" to "2.png.Wormhole", and so on).
The ransomware also presents a ransom note ("How to recover files encrypted by Wormhole.txt") that instructs victims to communicate with the attackers via Tox or qTox (providing download links for these tools). It advises victims to configure a proxy if the chat tool encounters internet connectivity issues.
Moreover, the note contains the attacker's Tox ID, serving as a unique identifier for communication purposes. It requests the recipient to send an encrypted file along with a Wormhole ID for test decryption.
Wormhole Ransom Note in Full
The complete text of the ransom note produced by Wormhole goes as follows:
Please contact us via Tox.chat tool or qtox tool
Download Tox.chat hxxps://tox.chat/download.html
Download qtox hxxps://github.com/qTox/qTox/blob/master/README.md#qtox
If your chat Tool cannot connect to the Internet, please set up a proxy.
Add our TOX ID and send an encrypted file and Wormhole ID for testing decryption.Our TOX ID 503313BA88174FDF187C5009A43B45CBC144D313EFBF98BB75BFA084B5743E3ECA94499F95ED
Your Wormhole ID: -
How is Ransomware Commonly Distributed Online?
Ransomware is commonly distributed online through various methods, often leveraging social engineering tactics and vulnerabilities in software or systems. Here are some common distribution methods:
Phishing Emails: One of the most prevalent methods is through phishing emails that contain malicious attachments or links. These emails are designed to appear legitimate and may trick users into opening attachments or clicking on links that download and execute ransomware onto their systems.
Malicious Links: Ransomware can be distributed through malicious links shared via email, social media, or instant messaging platforms. Clicking on these links may lead to the download and execution of ransomware on the victim's device.
Exploit Kits: Cybercriminals use exploit kits to exploit vulnerabilities in software or web browsers. When a user visits a compromised website, the exploit kit automatically downloads and installs ransomware onto the victim's computer without their knowledge.
Remote Desktop Protocol (RDP) Compromise: Attackers exploit weak or default credentials for Remote Desktop Protocol (RDP) to gain unauthorized access to a victim's system. Once inside, they deploy ransomware to encrypt files and demand a ransom.
Malvertising: Malicious advertisements (malvertising) on legitimate websites can redirect users to websites hosting ransomware. These advertisements may appear on popular websites and exploit vulnerabilities in the user's browser or plugins to deliver ransomware.
