Venus ransomware target publicly exposed Remote Desktop services

Share post:

A relatively new ransomware operation, identified as Venus, hacks into publicly exposed Remote Desktop services to encrypt Windows devices. According to researchers, Venus ransomware started operating in the middle of August 2022 and has since encrypted victims all over the world.

As soon as it is executed, Venus ransomware tries to terminate thirty-nine processes that are connected to database servers and Microsoft applications. The ransomware then continues to delete event logs, Shadow Copy Volumes, and disable Data Execution Prevention through an identified command.

When encrypting files, the ransomware appends the .venus extension. In each encrypted file, the ransomware will add a ‘goodgamer’ filemarker and other information to the end of the file. However, it remains unclear what this stands for.

Venus ransomware creates an HTA ransom note in the %Temp% folder, which is automatically displayed when the ransomware is ready to encrypt the device.

The analysis of the ransom note seen shows that the ransomware identified as “Venus” and shared a TOX address and email address, which can be used to reach the threat actor to negotiate a ransom payment. At the end of the ransom note is a Base64 encoded blob, which is probably the encrypted decryption key.

The sources for this piece include an article in BleepingComputer.

Featured Tech Jobs


Related articles

Cyber Security Today, Week in Review for week ending Friday, Feb. 23, 2024

This episode features discussion on the takedown of the LockBit ransomware gang

Breaking news: RCMP facing ‘alarming’ cyber attack

The RCMP is facing a serious cyber attack from an unspecified threat actor. The Mounties told CBC News today that a “breach of this magnitude is alarming.” “The situation is evolving quickly but at this time, there is no impact on RCMP operations and no known threat to the safety and security of Canadians,” a spokesperson

Leaked documents may show the inside of China’s hacking strategy

Documents apparently stolen by disgruntled employees to embarrass their firm may give insight into China's cyber

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways