KillDisk Malware Targets Linux With £160,000 Ransom Demand

A new variation of the KillDisk malware has been discovered, which targets Linux machines and renders them unbootable after encrypting files and demanding a large ransom.

However, according to researchers, even if victims pay the 222 Bitcoin ransom – approximately £160,000 at the time of writing – it is still unlikely that the attackers will actually decrypt the files.

The discovery marks a change in tact for the malware, which gained notoriety after being used in the attacks against the Ukraine power grid in 2015.

Don’t pay up

“These recent ransomware KillDisk variants are not only able to target Windows systems, but also Linux machines, which is certainly something we don’t see every day,” explain ESET researchers Robert Lipovsky and Peter Kalnai. “This may include not only Linux workstations but also servers, amplifying the damage potential.”

In both instances the ransom message is the same. It starts with a provocative “we are so sorry…” followed by the ransom amount of 222 Bitcoins, a Bitcoin address and a contact email.

Lipovsky and Kalnai note that “paying the ransom demanded for the recovery of encrypted files is a waste of time and money,” as the encryption keys are neither saved locally or  sent to a C&C server, meaning the people behind the attack are unable to supply the decryption keys needed.

They also comment on the unusual nature of the ransomware functionality, as this particular malware has previously been used in cyber espionage and sabotage operations.

“Considering the high ransom of around USD 250,000 – resulting in a low probability that victims would pay up, in addition to the fact that the attackers have not implemented an efficient way of decrypting the files, this seems more like a nail in the coffin, rather than a true ransomware campaign.”

Ransomware has dominated the cyber security landscape over the last 12 months. According to reports, attacks increased threefold in 2016, as 70 percent of businesses paid up to get their data back.

Quiz: Cyber security in 2016