Categories: EducationRansomware

Bitcoin Ransomware Education: SynAck

Virtually every other week, a new type of ransomware starts causing many headaches. The latest malware strain to surface is called SynAck, and it has been a relatively dormant malware up to this point. In fact, it was a strain most researchers had never heard of until very recently. This particular type of malware has been around since August 3rd and does not bear any resemblance to other ransomware types whatsoever.

SynAck Ransomware Baffles Security Researchers

Given the plethora of ransomware strains in circulation, it is almost impossible to come by a unique creation. Nearly every type of malware borrows one or more elements from existing types. Cybercriminals often look at what their competitors have to offer and strive to implement similar features in their own malware. Additionally, there is a growing number of ransomware-as-a-service (RaaS) platforms to contend with.

Everyone was surprised when they stumbled upon the SynAck ransomware. It has no correlations with any other existing types of malware in circulation, which is very unusual. Considering how the malware was first spotted over a month ago, one would have expected to see at least some infection reports by now. In fact, they are pretty difficult to come by, as no one has actively distributed SynAck on a large scale. That was, until a few days ago, when a large spike of activity was recorded on a global scale.

Thanks to the ID-Ransomware service, security researchers were able to determine around 100 incidents involving the SynAck ransomware. It took experts some time to analyze the various code samples, and the results were not what one would expect. There are at least three different variants of SynAck in circulation as we speak. Every version has its own ransomware note, yet none of them use a payment portal hosted on the clearnet or darknet.

It is not the first time we have seen ransomware developers move away from using a centralized payment portal. Although hosting such a site on the darknet usually ensures it remains operational for a few weeks, it also provides a way for security experts to identify the people responsible for these distribution campaigns. That is not in the best interest of cybercriminals, as they aim to remain anonymous on the internet at all times. Not opting for payment in the form of Bitcoin would certainly help in this regard, as the world’s leading cryptocurrency lacks any anonymity or privacy traits.

Instead, victims of the SynAck ransomware are asked to communicate with the developers through the BitMessage platform. It is unclear how much money victims must pay to get their computer files back, as the amounts seem to differ based on which of the three types has infected the computer in question. So far, it appears the malware is mainly distributed through Remote Desktop connections with the intent of targeting small businesses and large corporations. It is not a malware designed to infect consumer systems, although there will always be “collateral damage.”

One user claims he was asked to make a US$2,100 payment in Bitcoin to a specific wallet address. The address in question currently holds around 98 BTC in funds, although it is doubtful all of that money was a result of the SynAck ransomware distribution campaign. Moreover, around half of those funds have been moved out of this wallet address over the past few days, which may hint at how this address is part of a ransomware-as-a-service scheme. For the time being, there is no free decryption tool for SynAck victims.

JP Buntinx

JP Buntinx is a FinTech and Bitcoin enthusiast living in Belgium. His passion for finance and technology made him one of the world's leading freelance Bitcoin writers, and he aims to achieve the same level of respect in the FinTech sector.

Recent Posts

Fuel Games Envisions a Bright Future for Ethereum in the Video Gaming Industry

The Ethereum blockchain offers a lot of potential for innovation and new business models. Various projects and companies are actively…

36 mins ago

DLTs For All: Apollon Enables Businesses To Utilize Blockchain Technology to Enhance Revenue Streams

Apllon Foundation believes in the free flow of value through blockchain, giving retail and other businesses the opportunity to take…

2 hours ago

Cryptojacking Becomes Less Popular Due to Falling Cryptocurrency Prices, Report Claims

Cryptocurrency malware is a thriving business among online criminals. Hundreds of threats still exist, and this trend will not be…

2 hours ago

Grayscale Investments Successfully Attracts Institutional Investors

Various financial firms maintain active cryptocurrency portfolios these days. Grayscale Investments is one of the more well-known companies in this…

3 hours ago

What Is Open Banking, and Is It Good or Bad?

You know that major feature of blockchain technology? The one that cuts out the intermediaries and drives down the fees? Open…

4 hours ago

Why Traditional Assets Are Hard to Sell, and How Blockchain Might Be a Solution

Tokenization on the blockchain can make all asset groups easier to liquidate by creating a tradeable standard in security tokens.…

5 hours ago