C ybersecurity researchers have found a new ransomware called Thanos. This ransomware is being popularly advertised in the underground market as Ransomware-as-a-service (RaaS) tool. Another reason behind its rising popularity is that Thanos is the first ransomware family that seems to exploit the RIPlace technique in the Windows file system.
Thanos was initially spotted in January on an underground forum. It has been reportedly developed by a threat actor named as “Nosophoros”. However, a lot has changed since its initial emergence and now the latest feature of RIPlace technique has been integrated and used since February.
Since Thanos ransomware follows a RaaS model, the subscribers to this service are offered two packages:
- Light: A monthly subscription with limited capabilities.
- Company: A yearly subscription including additional features such as data-stealing functionalities, RIPlace technique and lateral-movement capabilities.
The other fascinating feature of the Thanos ransomware is its lateral movement which leverages SharpExec. The SharpExec tool can be downloaded from a GitHub repository and used to execute the Thanos client on remote computers.
Threat Summary
Name Thanos Threat type Ransomware Files Encrypted Using AES-256 in CBC mode Programming language used for Thanos Client C# Features & Capabilities RIPlace technique, lateral-movement, exfiltration of all files with a specific set of extensions, an anti-analysis tool allowing the client to perform several checks to determine whether it is executing within a virtual machine environment, and two obfuscation options.
Source : Snap Your Fingers Twice, Thanos Ransomware is Here!
Sécurité des mots de passe : bonnes pratiques pour éviter les failles La sécurité des…
Ransomware : comment prévenir et réagir face à une attaque Le ransomware est l’une des…
Cybersécurité et e-commerce : protéger vos clients et vos ventes En 2025, les sites e-commerce…
Les ransomwares : comprendre et se défendre contre cette menace En 2025, les ransomwares représentent…
RGPD et cybersécurité : comment rester conforme en 2025 Depuis sa mise en application en…
VPN : un outil indispensable pour protéger vos données Le VPN, ou « Virtual Private…
This website uses cookies.