BleepingComputer reports that Windows, Linux, ARM, BSD, and ESXi systems have been subjected to attacks by the novel Russia-based VanHelsing ransomware-as-a-service operation, which has already compromised a Texas city and tech firms in the U.S. and France since its emergence earlier this month.
Organizations in Commonwealth of Independent States countries have been spared from VanHelsing's intrusions, which involve the deployment of a C++-based ransomware that leverages the ChaCha20 algorithm to facilitate total and partial encryption of files below and above the 1 GB threshold, respectively, according to an analysis from Check Point Research. VanHelsing also features a pair of encryption modes, with normal prompting file and folder enumeration, file content encryption, and file renaming, and stealth separating the encryption and file renaming processes, said researchers, who noted that the ransomware's code has been littered with exclusion list logic and file extension errors that signify its lack of maturity. Meanwhile, affiliates part of VanHelsing were found to have been given 80% of ransomware payments, which could reach up to $500,000.
An In-Depth Guide to Ransomware
Get essential knowledge and practical strategies to protect your organization from ransomware attacks.
The cyberattack, which occurred around June 15, resulted in the theft of patient data including names, dates of birth, medical testing information, laboratory test results, and potentially health insurance information and Social Security numbers (SSNs) for a limited subset of patients.
