FONIX Ransomware: New Bad Boy in Town Looking for Partners

Modus operandi

• The ransomware is a low-key threat that uses four types of encryption algorithms, such as Salsa20, Chacha, RSA, and AES.
• After being executed with administrative privileges, the malicious payload performs multiple changes to systems. For example, disabling the task manager, creating a hidden service, and a few other operations.
• The author of this ransomware keeps 25% of any ransom amount from its affiliate network instead of charging a joining fee.
• The affiliates do not get instant access to decryptor utility or keys; instead, they must provide files from a victim system. 
• Consequently, RaaS operators decrypt the files and then send them back to the victims.

Recent association

• Recently, Egregor, a newly discovered ransomware family, has been found targeting corporations located in France, Germany, Italy, Japan, Mexico, Saudi Arabia, and the U.S.
• Last month, Mount Locker ransomware was found to be stealing victims' files before encrypting. Furthermore, the ransomware demanded multi-million dollar ransoms.
• In July, A new RaaS, called Thanos, was found being advertised on an underground market.

Conclusion