Chaos Malware Falsely Advertised as Ryuk Clone
Security researchers have been picking apart a new strain of malware, which they are now calling Chaos. The malware has been on their radar for a short while, first spotted in June 2021, and it looks like the bad actors behind it are shifting gears and getting ready to launch it for its first outing in the wild.
Chaos has not been used in an active attack or threat campaign so far, but it seems this moment is not too far. The hackers developing it and publishing updates on dark web forums habe been ramping up their update schedule and Chaos might soon be ready for its first excursion in the wild. The malware has gone through four significant updates in just two months' time.
Researchers working with Trend Micro analyzed Chaos and discovered a few interesting things about it. For a product that might soon be up for sale to other budding hackers, Chaos does a lot of lying. First of all, it pretends to be a fork of the infamous Ryuk ransomware, but coded in .NET. This is signposted even on the ransom screen containing the note and crypto wallet strings.
However, when Trend Micro researcher Monte de Jesus picked apart the malware's innards, it turned out that this is far from the case. Chaos operates in a way that makes it more similar to a "destructive trojan" than a regular ransomware.
Before it encrypts files, Chaos replaces their contents with random bytes. This effectively means that even if a victim did pay the ransom and obtained the decryption key, they would simply decrypt their files to large blobs of random data.
A curious addition to the toolkit Chaos possesses, in addition to its wiper properties, is its ability to spread to any and all drives connected to the victim system. This is an issue because this worming capability also covers removable drives.
The malware's ransom note is called "read_it.txt". In it, Chaos asks for just over $6 thousand in bitcoin.
As the malware got updated, it slowly started behaving more like traditional ransomware. Gradual updates introduced the ability to properly encrypt small file sizes without destroying the original data in them first. However, even in its latest iteration, Chaos is not a full-fledged, proper ransomware. That will probably change as the hackers behind it develop it further. This, however, does not diminish the danger Chaos poses as a destructive data wiper tool.
