GoKawiilThe latest variant of an emerging ransomware may be far more destructive than its operators intended, acting as a wiper that deletes many of an organization's captured files instead of encrypting them, as typical ransomware does. This scenario makes recovery impossible for defenders while complicating the possibility of holding files for ransom for the attackers.
The Vect 2.0 variant of the ransomware-as-service (RaaS) operation, which first appeared last December, has a flaw across its versions for Windows, Linux, and VMware ESXi that inadvertently and permanently destroys so-called "large files" rather than encrypting them, according to a report published this week by Check Point Software.
For all files of only 128KB or higher, "this effectively makes Vect a wiper for virtually any file containing meaningful data, enterprise assets such as VM disks, databases, documents and backups included," according to the report. Check Point has confirmed that the flaw, which "discards three of four decryption nonces for every file above 131,072 bytes (128 KB)," is identical across all three platform variants.
Related:Feuding Ransomware Groups Leak Each Other's Data
The Vect Flaw, Unpacked
The flaw exists because, according to Vect's ChaCha20-IETF encryption scheme, the malware encrypts four independent chunks of each "large file" using four freshly generated random 12 byte nonces, but appends only the final nonce to the specific encrypted file on disk, according to Check Point.
"The first three nonces, each required to decrypt its respective chunk, are generated, used, and silently discarded," according to the report. "They are never stored on disk, in the registry, or transmitted to the operator."
ChaCha20-IETF requires both the 32 byte key and the exact matching 12 byte nonce to unlock each chunk of data, so the first three quarters of every large file are unrecoverable by anyone — even the ransomware operators themselves. "Since the vast majority of operationally critical files exceed this 'large-size' threshold, Vect 2.0 functions in practice as a data wiper with a ransomware facade," according to Check Point.
The variant also demonstrates other incomplete implementation issues, such as: encryption modes that are parsed but never applied, string obfuscation routines that accidentally cancel themselves out, and a cipher that is incorrectly described in public reporting, according to the report.
Attackers and Defenders Both Affected
... continue reading