Cybersecurity researchers have found a new ransomware called Thanos. This ransomware is being popularly advertised in the underground market as Ransomware-as-a-service (RaaS) tool. Another reason behind its rising popularity is that Thanos is the first ransomware family that seems to exploit the RIPlace technique in the Windows file system. This technique goes undetected in most antivirus, anti-ransomware, and Endpoint Detection and Response (EDR) solutions as it bypasses the security products by replacing all sensitive files on the victim’s machine.
Thanos was initially spotted in January on an underground forum. It has been reportedly developed by a threat actor named as “Nosophoros”. However, a lot has changed since its initial emergence and now the latest feature of RIPlace technique has been integrated and used since February.
Since Thanos ransomware follows a RaaS model, the subscribers to this service are offered two packages:
- Light: A monthly subscription with limited capabilities.
- Company: A yearly subscription including additional features such as data-stealing functionalities, RIPlace technique and lateral-movement capabilities.
The other fascinating feature of the Thanos ransomware is its lateral movement which leverages SharpExec. The SharpExec tool can be downloaded from a GitHub repository and used to execute the Thanos client on remote computers.
Threat Summary |
|
| Name | Thanos |
| Threat type | Ransomware |
| Files Encrypted Using | AES-256 in CBC mode |
| Programming language used for Thanos Client | C# |
| Features & Capabilities | RIPlace technique, lateral-movement, exfiltration of all files with a specific set of extensions, an anti-analysis tool allowing the client to perform several checks to determine whether it is executing within a virtual machine environment, and two obfuscation options. |
