New Ransomware Spreading Rapidly in China Infected Over 100,000 PCs

A new piece of ransomware is spreading rapidly across China that has already infected more than 100,000 computers in the last four days as a result of a supply-chain attack... and the number of infected users is continuously increasing every hour.

What's Interesting? Unlike almost every ransomware malware, the new virus doesn't demand ransom payments in Bitcoin.

Instead, the attacker is asking victims to pay 110 yuan (nearly USD 16) in ransom through WeChat Pay—the payment feature offered by China's most popular messaging app.
Ransomware + Password Stealer — Unlike WannaCry and NotPetya ransomware outbreaks that caused worldwide chaos last year, the new Chinese ransomware has been targeting only Chinese users.

It also includes an additional ability to steal users' account passwords for Alipay, NetEase 163 email service, Baidu Cloud Disk, Jingdong (JD.com), Taobao, Tmall , AliWangWang, and QQ websites.

A Supply Chain Attack — According to Chinese cybersecurity and anti-virus firm Velvet Security, attackers added malicious code into the "EasyLanguage" programming software used by a large number of application developers.

The maliciously modified programming software was designed to inject ransomware code into every application and software product compiled through it—another example of a software supply-chain attack to spread the virus rapidly.
More than 100,000 Chinese users who installed any of the above listed infected applications got their systems compromised. This ransomware encrypts all files on an infected system, except files with gif, exe, and tmp extensions.

Using Digital Signatures — To defend against Antivirus programs, the malware uses a program with valid signature to execute the virus code and also avoids encrypting data in some specific directories, like "Tencent Games, League of Legends, tmp, rtl, and program."

Once encrypted, the ransomware pops-up a note, asking users to pay 110 yuan to attackers' WeChat account within 3 days to receive the decryption key.
If not paid within displayed time, the malware threatens to delete the decryption key from its remote command-and-control server automatically.

Besides encrypting user files, the ransomware also silently steals users login credential for popular Chinese websites and social media accounts and send them to a remote server.

It also gathers system information including CPU model, screen resolution, network information and list of installed software.

Poor Ransomware Has Been Cracked — Chinese cybersecurity researchers found that the ransomware has poorly been programmed and attackers lied about the encryption process.

The ransomware note says users' files have been encrypted using DES encryption algorithm, but in reality, it encrypts data using a less secure XOR cipher and stores a copy of the decryption key locally on the victim's system itself in a folder at following location:

%user%\AppData\Roaming\unname_1989\dataFile\appCfg.cfg

Using this information, the Velvet security team created and released a free ransomware decryption tool that can easily unlock encrypted files for victims without requiring them to pay any ransom.

Researchers also managed to crack and access attackers' command-and-control and MySQL database servers, and found thousands of stolen credentials stored on them.

Who Is Behind This Ransomware Attack? — Using publicly available information, researchers have found a suspect, named "Luo," who is a software programmer by profession and developed applications like "lsy resource assistant" and "LSY classic alarm v1.1"

Lua's QQ account number, mobile number, Alipay ID and email IDs match with the information researchers collected by following the attacker's WeChat account.

After being notified of the threat, WeChat has also suspended the attackers account on its service that was being used to receive the ransom payments.

Velvet researchers have also informed Chinese law enforcement agencies with all available information for further investigation.

Chinese Hacker Behind WeChat Ransomware Arrested

UPDATE (06/12/2018) — Dongguan Police have arrested a 22-year-old Chinese man who has admitted his role in creating and spreading a new ransomware malware across China that has compromised over 100,000 computers in past five days, asking victims to pay ransom via WeChat payment service.

As explained in the article above, the hacker (whose name and identity was revealed by security researchers as Luo Moumou) didn't do much to clear his tracks, making it easier for authorities to track him down within 24 hours.

"After the trial, the suspect Luo Moumou confessed to the fact that he was making new ransomware to destroy the computer information system and using WeChat to pay for blackmail," Chinese media reported.

"According to his confession, in June 2018, Luo Moumou independently developed the virus 'cheat, which was used to steal the account password of others Alipay, and then steal funds through transfer."

Moumou was arrested on December 5th from Maoming, a city located in southwestern Guangdong, China.