Threat Management, Malware, Ransomware

Paradise ransomware is a fresh hell for computer users

A newly discovered ransomware-as-a-service program called Paradise may be attempting to infect computers via hacked Remote Desktop services, according to BleepingComputer creator and security expert Lawrence Abrams.

Upon execution, the ransomware relaunches itself to gain administrative privileges, and then encrypts a device's files with an RSA-1024 algorithm, appending the string "id-[affiliate_id].[affiliate_email].paradise" to affected file names, Abrams explains in a news report published on Monday.

"The ransomware will write the RSA encryption key that was used to encrypt a victim's files to the %UserProfile%DecriptionInfo.auth file. This file will then be encrypted by a master encryption key that was bundled in the ransomware executable," Abrams writes. "This allows the developers to extract a victim's unique RSA key after they have paid a ransom."

The desktop image of infected machines displays a black background with white lettering that states, "All your files were encrypted!" along with instructions to read a corresponding .txt file. The ransom note itself contains the email address of the attackers and payment instructions. The note states that the victim's files have been encrypted due to a "security problem," and that the price to restore files back to normal "depends on how fast you write to us." Victims are able to have three files of their choice decrypted for free.

Abrams believes that Paradise may use Demote Desktop services as an infection vector based on entries found in the event log of an infected computer.

Bradley Barth

As director of community content at CyberRisk Alliance, Bradley Barth develops content for SC Media online conferences and events, as well as video/multimedia projects. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.