Cicada Ransomware – What You Want To Know

What’s the Cicada ransomware?

Cicada (often known as Cicada3301) is subtle ransomware written in Rust that has claimed greater than 20 victims since its discovery in June 2024.

Why is the ransomware referred to as Cicada?

The criminals behind Cicada seem to have named it after the mysterious Cicada 3301 puzzles posted on the web between 2012 and 2014, seemingly to recruit extremely smart people. 

In fact, there is no such thing as a motive to consider that the ransomware is in any style associated to the enigmatic puzzles that appeared a decade earlier than it – aside from by way of the title.

Honest sufficient. What kind of firms are being hit by Cicada?

In line with a weblog submit by safety researchers at Morphisec, not less than 21 firms, predominantly in North America and the UK, have been hit by Cicada since June 18, 2024. 

A lot of the organisations affected have been small and mid-sized companies (18), with the remaining three described as enterprises. Victims have been famous in a wide range of business sectors, together with manufacturing/industrial, healthcare, retail, and hospitality. 

Organizations hit by the Cicada ransomware are greeted by a message telling them that attackers have downloaded their vital knowledge and that information on the corporate’s community have been encrypted. 

An additional message says that the gang is ready to offer “proof that the information has been stolen” and can delete all of the stolen info and “assist you to rebuild your infrastructure and forestall related assaults sooner or later” if a cryptocurrency fee is made.

And I suppose they are going to publish the information should you do not pay up?

Sure, the Cicada gang says that if a ransom shouldn’t be paid in time, then the stolen knowledge shall be revealed on its weblog. However in addition they say that the information shall be despatched “to all regulatory authorities in your nation, in addition to to your prospects, companions, and opponents.”

That is a nasty menace. Do we all know who’s behind Cicada?

Though we have no idea the identities of these accountable, safety researchers say that there are placing similarities between Cicada and the ALPHV BlackCat ALPHV ransomware – which can also be written in Rust. 

Whereas there is no definitive proof, the similarities between Cicada and BlackCat, together with the usage of Rusy, evasion strategies, and timing, counsel a doable connection.

You have talked about Rust just a few occasions. What’s that?

Rust is a programming language that has develop into fashionable with ransomware builders lately. Particularly, ransomware teams like BlackCat and Hive have used Rust to create strains of their malware – partially as a result of it makes reverse-engineering extra tough and as a result of difficulties some malware detection techniques have in reliably detecting Rust-based ransomware by way of static evaluation.

I assumed the authorities had taken motion to disrupt the ALPHV BlackCat ransomware?

Properly remembered. In December 2013, the US Division of Justice introduced it had disrupted the ransomware gang’s operations and seized decryption keys to assist victims unlock their knowledge with out paying a ransom. 

Nonetheless, that victory was short-lived. ALPHV BlackCat re-emerged, threatened retaliation in opposition to international locations that assisted with the takedown, and explicitly warned that it could assault hospitals in future.

They do not sound like a pleasant bunch.

That is placing it mildly.

What can I do to scale back the danger of Cicada and different ransomware threats attacking my organisation?

• Maintain your safety software program up to date.
• Educate your workers about phishing emails and different social engineering strategies.
• Implement sturdy backup and restoration procedures.
• Monitor your surroundings for suspicious exercise.
• Take into account using menace searching providers to proactively determine and mitigate threats.

Different finest practices embrace creating sturdy, distinctive passwords, and holding software program present. It’s also suggested to report ransomware assaults to CISA, an area FBI discipline workplace or a Secret Service discipline workplace.

Editor’s Notice: The opinions expressed on this visitor writer article are solely these of the contributor and don’t essentially mirror these of Tripwire.