New Ransomware Spreading Rapidly in China Infected Over 100,000 Computers.

🆕🆕🆕🆕 NB: While all of you enjoy Reading Our Educative articles, Please, Help us by Donating any amount of Money to Help the Communities of AWUPI in Kijomoro Sub-County, Maracha District - Uganda, by Sending any amount of Money to Mr Stephen Esua, Telephone Number +256 784 179957.
Little amount of your Financial Contributions is Highly Appreciated.
This Charity is Aimed at raising Ugandan Shillings 62 million (17500$) which will be used to buy Chairs, Utensils, Tents and many  more items to Cater for Community Needs during Parties, Funerals and other Events.

Remember: Gifted Hands are those that Give.

Thanks.
🆕🆕🆕🆕.

NEW RANSOMWARE DISCOVERED.

A new piece of ransomware is spreading rapidly across China that has already infected more than 100,000 computers in the last four days as a result of a supply-chain attack... and the number of infected users is continuously increasing every hour.
What's Interesting? Unlike almost every ransomware malware, the new virus doesn't demand ransom payments in Bitcoin.
Instead, the attackers are asking victims to pay 110 yuan (nearly USD 16) in ransom through WeChat Pay—the payment feature offered by China's most popular messaging app.
ransomware malware wechat note
Ransomware + Password Stealer — Unlike WannaCry and NotPetya ransomware outbreaks that caused worldwide chaos last year, the new Chinese ransomware has been targeting only Chinese users.
It also includes an additional ability to steal users' account passwords for Alipay, NetEase 163 email service, Baidu Cloud Disk, Jingdong (JD.com), Taobao, Tmall , AliWangWang, and QQ websites.
A Supply Chain Attack — According to Chinese cybersecurity and anti-virus firm Velvet Security, attackers added malicious code into the "EasyLanguage" programming software used by a large number of application developers.
The maliciously modified programming software was designed to inject ransomware code into every application and software product compiled through it—another example of a software supply-chain attack to spread the virus rapidly.
chinese ransomware attack
More than 100,000 Chinese users who installed any of the above listed infected applications got their systems compromised. This ransomware encrypts all files on an infected system, except files with gif, exe, and tmp extensions.
Using Stolen Digital Signatures — To defend against Antivirus programs, attackers signed their malware code with a trusted digital signature from Tencent Technologies and avoid encrypting data in some specific directories, like "Tencent Games, League of Legends, tmp, rtl, and program."
Once encrypted, the ransomware pops-up a note, asking users to pay 110 yuan to attackers' WeChat account within 3 days to receive the decryption key.
tencent digital signature
If not paid within displayed time, the malware threatens to delete the decryption key from its remote command-and-control server automatically.
Besides encrypting user files, the ransomware also silently steals users login credential for popular Chinese websites and social media accounts and send them to a remote server.
It also gathers system information including CPU model, screen resolution, network information and list of installed software.
Poor Ransomware Has Been Cracked — Chinese cybersecurity researchers found that the ransomware has poorly been programmed and attackers lied about the encryption process.

The ransomware note says users’ files have been encrypted using DES encryption algorithm, but in reality, it encrypts data using a less secure XOR cipher and stores a copy of the decryption key locally on the victim's system itself in a folder at following location:
%user%\AppData\Roaming\unname_1989\dataFile\appCfg.cfg
Using this information, the Velvet security team created and released a free ransomware decryption tool that can easily unlock encrypted files for victims without requiring them to pay any ransom.
Researchers also managed to crack and access attackers' command-and-control and MySQL database servers, and found thousands of stolen credentials stored on them.
Who Is Behind This Ransomware Attack? — Using publicly available information, researchers have found a suspect, named “Luo,” who is a software programmer by profession and developed applications like "lsy resource assistant" and "LSY classic alarm v1.1"
malware hacker app
Lua's QQ account number, mobile number, Alipay ID and email IDs match with the information researchers collected by following the attacker’s WeChat account.
After being notified of the threat, WeChat has also suspended the attackers account on its service that was being used to receive the ransom payments.
Velvet researchers have also informed Chinese law enforcement agencies with all available information for further investigation.

PROUD LUGBARA OSUTA YUSUF, A CAREER POLITICIAN, BARRISTER, STUDENT FOR LIFE AND TALENTED IN TECHNOLOGY.