The recently discovered B0r0nt0K ransomwareinfects both Linux and Windows servers and demands $75,000 ransom to the victims.
A new piece of ransomware called B0r0nt0K appeared in the threat landscape, it is targeting web sites and demanding a 20 bitcoin ransom to the victims (roughly $75,000). This B0r0nt0K ransomware infects both Linux and Windows servers.
The news was first reported by Bleeping Computer, in a BleepingComputer forum post, a user reported the infection of a website running on Ubuntu 16.04. The ransom encrypts all files and renames them by appending.rontokextension to the file names. The user that disclosed the news on the forum was only able to provide the URL of the payment site located at https://borontok.uk/. To access the website the victim have to provide the personal ID.
According to the popular malware researcher Michael Gillespie, when the B0r0nt0K ransomware encrypts a file it will base64 the encrypted data.
“The file’s name will also be renamed by encrypting the filename, base64 encoding it, url encoding it, and finally appending the .rontok extension to the new file name. An example of a encrypted file’s name is zmAAwbbilFw69b7ag4G4bQ%3D%3D.rontok.” reported Bleeping Computer.
By accessing the payment site, the user will be presented with a payment page including payment instructions (i.e. Ransom amount, the bitcoin payment address, and the contact email firstname.lastname@example.org). Experts pointed out that the malware author appears to be willing to negotiate the ransom amount.
BleepingComputer analyzed the source code of the payment site and discovered the string “Vietnamese Hacker” in a comment, a circumstance that could suggest that the malware author is Vietnamese.
Further details are reported in the post published on Bleeping Computer.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.