A new piece of ransomware called B0r0nt0K appeared in the threat landscape, it is targeting web sites and demanding a 20 bitcoin ransom to the victims (roughly $75,000). This B0r0nt0K ransomware infects both Linux and Windows servers.
The news was first reported by Bleeping Computer, in a BleepingComputer forum post, a user reported the infection of a website running on Ubuntu 16.04. The ransom encrypts all files and renames them by appending
According to the popular malware researcher Michael Gillespie, when the B0r0nt0K ransomware encrypts a file it will base64 the encrypted data.
“The file’s name will also be renamed by encrypting the filename, base64 encoding it,
By accessing the payment site, the user will be presented with a payment page including payment instructions (i.e. Ransom amount, the bitcoin payment address, and the contact email firstname.lastname@example.org). Experts pointed out that the malware author appears to be willing to negotiate the ransom amount.
Further details are reported in the post published on Bleeping Computer.