Synack Ransomware

The Synack Ransomware is a Trojan that locks your files with encryption to use it as leverage in a Bitcoin-extorting tactic. Most likely to inflate the value of the content they can hold hostage, threat actors are distributing variants of the Synack Ransomware to network-accessible systems associated with business server operations. Abiding by proper network security practices and backup strategies can reduce your vulnerability to this threat, and various anti-malware products can block or uninstall the Synack Ransomware.

Servers at Risk throughout the World

While its statistics for infection are much lower than the typical distribution rates for RaaS Trojans, the Synack Ransomware's campaign has been overall effective at compromising targets for cryptocurrency extortion. Threat actors have been increasing their rates of attack throughout August, with the Trojan managing to infect PCs in Europe, Asia and both Americas. Poor network security is the common factor malware analysts can most clearly verify in these cases, which could allow third parties to install the Synack Ransomware manually.

The Synack Ransomware installations are occurring after its threat actors gain backdoor access through 'brute-force' methods that let them crack a Windows Server machine's login remotely, and default RDP features enabling relatively comprehensive UI control. The Synack Ransomware uses a partially AES-based enciphering function to encrypt various formats of data on the PC, such as documents, spreadsheets, and other business records. Unlike most file-blocking Trojans, the Synack Ransomware doesn't include a static, standardized tag to append to every file's name; instead, the Synack Ransomware inserts a pseudo-extension of ten, random characters.

The text-based ransoming messages the Synack Ransomware's admins are providing to any affected PC users ask for negotiations through one of various email addresses. Ransoms for the decryption solution for restoring your files are averaging at two thousand dollars in the Bitcoin cryptocurrency, which malware experts recommend avoiding paying, if possible. Current statistics on the associated wallet address shows that the threat actors have over four hundred, thousand USD in Bitcoins, as of early September.

The Value of Network Security for Securing Your Files

Attacks by the Synack Ransomware, for the moment, focus on business servers and similar targets with valuable media that would justify the expensive ransoms the Synack Ransomware's threat actors request. Malware researchers have yet to find any infection vectors related to the Synack Ransomware's campaign not using RDP-based installation methods, which implies prior compromises of the machine by breaking its login credentials. Keeping up rotations of unique, complex passwords can reduce a network's vulnerability to such infection strategies, which can compromise simplistic passwords (such as 'admin123' or 'password1') easily.

The Synack Ransomware's campaign isn't regionally-specific and appears to be running three major variants of the Trojan concurrently. Other details, such as its wallet activity and associated ransoming negotiation addresses, are indicative that the Synack Ransomware is part of a Ransomware-as-a-Service or RaaS business plan. As a result, the content it encodes, whose systems it infects, and the particulars of the ransoming process all are potentially flexible. Use your anti-malware programs for disinfecting the Synack Ransomware from an already compromised machine or halting its installation, and backups for data restoration, as appropriate.

Staying small in raw distribution is a financially viable path for threat actors more interested in keeping samples for security researchers minimized than attacking as many targets as possible. The Synack Ransomware is showing the world just how much money a con artist can make by attacking a handful of well-chosen victims with encryption.