TheMerkle SynAck Ransomware

Virtually every other week, a new type of ransomware begins causing many headaches. The latest malware strain is called SynAck, which has been a relatively dormant malware up until this point. In fact, it was a strain most researchers had never heard of until very recently. This particular type of malware has been around since August 3rd and does not bear any similarities to other ransomware types whatsoever.

SynAck Ransomware Baffles Security Researchers

Given the plethora of ransomware strains in circulation, it is almost impossible to come by a unique creation. Nearly every type of malware borrows one or more elements from existing types. Cybercriminals are often looking at what competitors have to offer and strive to implement similar features in their own malware. Additionally, there is the growing number of ransomware-as-a-service platforms to contend with.

Everyone was surprised when they stumbled upon the SynAck ransomware. It has no correlations which any other existing types of malware in circulation, which is very unusual. Considering how the malware was first spotted over a month ago, one would expect to see at least some infection reports by now. Those are pretty difficult to come by, as no one had actively distributed SynAck on a large scale. That was, until a few days ago, when a large spike of activity was recorded on a global scale.

Thanks to the ID-Ransomware service, security researchers were able to determine around 100 incidents involve the SynAck ransomware. It took experts some to analyze the various code samples and the results are not what one would expect. There are at least three different variations of SynAck in circulation as we speak. Every version has its own ransomware note, yet none of them use a payment portal hosted on the clearnet or darknet.

It is not the first time we see ransomware developers move away from using centralized payment portals. Although hosting such a site on the darknet usually ensures it remains operational for a few weeks, it also provides a way for security experts identify the people responsible for these distribution campaigns. That is not in the best interest of cybercriminals, as they aim to remain anonymous on the internet at all times. Not opting for a Bitcoin payment would certainly help in this regard, as the world’s leading cryptocurrency lacks any anonymity or privacy traits.

Instead, victims of the SynAck ransomware are asked to communicate with the developers through the BitMessage platform. It is unclear how much money victims have to pay to get their computer files back, as the amount seems to differ based on which of the three types infects the computer in question. So far, it appears the malware is mainly distributed through Remote Desktop connections with the intent of targeting small businesses and large corporations. It is not a malware designed to infect consumers’ systems, although there will always be “collateral damage.”

One user claims he was asked to make a $2,100 payment in Bitcoin to a specific wallet address. Said address currently holds around 98 BTC in funds, although it is doubtful all of this money is a result of the SynAck ransomware distribution campaign. Moreover, around half of the funds have been moved out of this wallet address over the past few days, which may hint at how this address is part of a ransomware-as-a-service scheme. For the time being, there is no free decryption tool for SynAck victims.

Click here to