The ransomware virus is getting more and more greedy: it specifically targets "financial sponsors" and demands huge amounts of Bitcoin

On September 11, Thai hospitals and companies were attacked by ransomware and were asked to pay Bitcoin to restore computer systems and data. So far, some attacked institutions have paid 1 million Thai baht (about 218,300 yuan) in ransom as required by hackers.

The goal is clear, and the target is the "financial sponsor".

According to the security warning previously released by Tencent Security Emergency Center, ransomware often uses domain servers as a springboard for targeted attacks and RDP blasting intrusions. After controlling the server, hackers will scan and invade more machines in the intranet to encrypt the ransomware again, resulting in a large number of terminals being infected by the ransomware. Hospitals, government agencies, and large enterprises are precisely the main targets of ransomware attacks:

In June this year, the servers of Japanese automobile giant Honda were attacked by the Ekans ransomware. Since this new virus has the function of locking the industrial control systems and machinery in the factory, Honda's factories in many countries except its headquarters in Japan have suspended production, which ultimately caused Honda's production to fall by 4.3% in July.

On July 19, the server of the School of Social and Behavioral Analysis at the University of Utah was hacked by ransomware, and data including the information of school faculty and students was leaked. In order to prevent hackers from publishing the information, the University of Utah paid the hackers about $457,059.24 in Bitcoin.

On August 24, South Korean semiconductor giant SK Hynix was attacked by hackers using the ransomware Maze, which encrypted more than 11TB of data and released about 600MB of data. SK Hynix did not comment on this, so the outside world is not yet clear about the amount of the ransom demanded.

On September 8, Argentina's official immigration agency, Dirección Nacional de Migraciones, temporarily suspended border operations in the country due to a Netwalker ransomware attack. The hackers demanded a ransom of $4 million in Bitcoin, but Argentina rejected the request.

Must be settled in Bitcoin, untraceable

Although there are dozens of known ransomware variants, they all operate in the same way: after taking over servers and computers, they directly encrypt the system and files, and require users to remit a specified amount of Bitcoin to the hacker's Bitcoin address (similar to a bank account) within a certain period of time. If users refuse to pay the ransom, the files will be made public or destroyed.

As the most mainstream encrypted digital currency, Bitcoin has the characteristics of high anonymity, wide recognition, and real-time cross-border circulation. It has always been the "hard currency" in the global gray and black industry transactions. This means that users or the police who only know the hacker's Bitcoin address find it difficult to track the hacker's location in the real world, and naturally there is no way to claim compensation or hold him accountable. This is also the fundamental reason why the ransomware virus has been rampant since 2017.

It should be pointed out that due to the low cost and low risk of using ransomware to obtain assets, such activities have now become an industry. In addition to hackers who develop new ransomware, there are also many groups that specialize in spreading and operating ransomware, such as dedicated customer service to guide encrypted users to pay.

In this context, users can only reduce the possibility of being attacked by updating their systems and firewalls, not logging into unfamiliar websites at will, and not downloading files from unknown sources.