Haz clic aquí​​  to download the complete analysis as a PDF.​​ 

Hackers need not search the dark web for access to their very own ransomware platforms these days. Cybercriminals are continually finding new ways to promote their underground businesses and gain the attention of new customers and novice hackers. Several threat actors have recently taken to popular social media and open sources like YouTube, Vimeo, and Sellix to advertise and demonstrate their discount-priced $40 ransomware-as-a-service (RaaS) builder called ZagreuS.​​ 

Video de demostración en YouTube del generador de ransomware ZagreuS. (Fuente: Recorded Future)​​ 

The ZagreuS ransomware offers several attractive and easy-to-use features that make it accessible and manageable for low-level beginner hackers. According to the sellers, the ransomware features include:​​ 

• Asymmetric encryption. Uses a hybrid combination of AES-256 and RSA-2048 algorithms to lock files on the target machine.​​ 
• It deletes shadow copies and is claimed to encrypt files at a very high speed.​​ 
• Claims to bypass UAC.​​ 
• Built-in loader that can be customized to drop additional payloads such as RATs (remote-access trojans).​​ 
• The attacker can monitor the number of victims infected with the ransomware.​​ 
• Easy personalization. Enter your contact information and bitcoin address for fast payment.​​ 

A new user advertised the ZagreuS features on a deep web hacking forum. (Source: Recorded Future)​​ 

Según el vendedor original, ZagreuS está diseñado para atacar redes más grandes de empresas, compañías y hospitales. El video demo de 11 minutos publicado en YouTube describe que el vendedor recibirá una comisión del 30 por ciento por cada rescate recaudado, mientras que el 70 por ciento restante lo retendrá el operador/comprador. El generador de ransomware está actualmente en tendencia a un precio bajo de 40 dólares estadounidenses, pagados en criptomonedas a la cartera del vendedor.​​ 

Several interested buyers left comments on the sale posts on underground forums inquiring if anyone had tested the ZagreuS builder, and expressed interest in trying it out. Typically, in these instances, the low price of the builder is an indication that the seller is lacking experience or that the tool is not very valuable. Insikt Group has found that most often, the tool does not function well, can be easily decrypted, and it can be very difficult for the “affiliates” criminals to make a profit off of their victims.​​ 

A new user advertised the ZagreuS features on a deep web hacking forum. (Source: Recorded Future)​​ 

Many online platforms and social media applications are aware of these advertisements and work to have them removed. When this particular demo video was removed from the original YouTube channel, the threat actor quickly uploaded it again under a different link and pivoted to other platforms for clear web and deep web marketing, including sellix.io, RAID forums, hackforums, and Github.​​ 

Ransomware has stolen the cybercrime stage in the past year, quickly becoming one of the most damaging and prevalent forms of cyber attacks. Industries such as state and local government, healthcare, and finance have taken an especially hard hit from ransomware attacks in the past year, and it does not appear to be slowing down. There are currently over 1,800 variants of ransomware, with the top 45 variants bringing in the most ransom money.​​ 

(Source: Recorded Future)​​ 

Aunque la barrera de entrada para que los actores maliciosos accedan al ransomware fue más baja que nunca, muy pocos delincuentes obtienen beneficios con estas herramientas RaaS simples y de bajo costo. Sin embargo, quienes tienen éxito aprovecharon la situación e incrementaron las demandas de rescate. Algunos incluso practican una doble explotación de sus víctimas : exigen un rescate y aun así liberan los datos personales de las víctimas para venderlos en foros clandestinos luego de pagar.​​ 

For more information on security intelligence to defend against ransomware threats, visit www.recordedfuture.com.​​