Snap Your Fingers Twice, Thanos Ransomware is Here!

C ybersecurity researchers have found a new ransomware called Thanos. This ransomware is being popularly advertised in the underground market as Ransomware-as-a-service (RaaS) tool. Another reason behind its rising popularity is that Thanos is the first ransomware family that seems to exploit the RIPlace technique in the Windows file system.

Thanos was initially spotted in January on an underground forum. It has been reportedly developed by a threat actor named as “Nosophoros”. However, a lot has changed since its initial emergence and now the latest feature of RIPlace technique has been integrated and used since February.

Since Thanos ransomware follows a RaaS model, the subscribers to this service are offered two packages:

1. Light: A monthly subscription with limited capabilities.
2. Company: A yearly subscription including additional features such as data-stealing functionalities, RIPlace technique and lateral-movement capabilities.

The other fascinating feature of the Thanos ransomware is its lateral movement which leverages SharpExec. The SharpExec tool can be downloaded from a GitHub repository and used to execute the Thanos client on remote computers.

Threat Summary
Name	Thanos
Threat type	Ransomware
Files Encrypted Using	AES-256 in CBC mode
Programming language used for Thanos Client	C#
Features & Capabilities	RIPlace technique, lateral-movement, exfiltration of all files with a specific set of extensions, an anti-analysis tool allowing the client to perform several checks to determine whether it is executing within a virtual machine environment, and two obfuscation options.

Source : Snap Your Fingers Twice, Thanos Ransomware is Here!