[ad_1]
A new Onyx ransomware operation is destroying files larger than 2MB instead of encrypting them, preventing those files from being decrypted even if a ransom is paid.
Last week, security researcher MalwareHunterTeam discovered that a new ransomware operation called Onyx had been launched.
Like most ransomware operations today, Onyx threat actors steal data from a network before encrypting devices. This data is then used in double extortion schemes where they threaten to publicly release the data if a ransom is not paid.
The ransomware gang has been reasonably successful so far, with six victims on their data leak page.
Onyx ransomware destroys most data
The technical functionality of the Onyx ransomware was not known until today, when MalwareHunterTeam found a sample of the encryptor.
What was found is worrying as the ransomware will overwrite many files with random junk data instead of encrypting them.
As you can see from the source code below, Onyx encrypts files less than 2MB in size. However, according to MalwareHunterteam, Onyx will overwrite any file larger than 2MB with junk data.
Since this is randomly created and unencrypted data, there is no way to decrypt files larger than 2MB in size.
Even if the victim pays, the decryptor can recover only the smallest encrypted files.
According Jiřà Vinopalforensic analyst of the CERT of the Czech Republic, this ransomware is the based on Chaos ransomwarewhich includes the same harmful encryption routine.
As the destructive nature of the encryption routine is intentional and not an error, it is strongly recommended that victims do not pay the ransom.
04/28/22: Fixed files larger than 2MB being destroyed and this is a Chaos ransomware variant.
[ad_2]