Karmen Ransomware Variant Introduced by Russian Hacker

On March 4, 2017, a member of a top-tier cyber criminal community with the username “Dereck1” mentioned a new ransomware variant called “Karmen.”

Further investigation revealed that “DevBitox,” a Russian-speaking cyber criminal, was the seller behind the Karmen malware on underground forums in March 2017.

However, the first cases of infections with Karmen were reported as early as December 2016 by victims in Germany and the United States.

Background

The Karmen malware derived from “Hidden Tear,” an open source ransomware project, available for purchase by anyone. As is typical for ransomware infections, Karmen encrypts files on the infected machine using the strong AES-256 encryption protocol, making them inaccessible to the user and may trigger a ransom note or instructions demanding that the user pay a large sum of money to obtain the decryption key from the attacker.

A notable feature of Karmen is that it automatically deletes its own decryptor if a sandbox environment or analysis software is detected on the victim’s computer.

Here are screenshots of the affiliate’s page seen by purchasers of Karmen. Configuration of Karmen through this interface allows actors to change the malware’s settings using a control panel that requires very minimal technical knowledge.

Follow this link to read more https://www.recordedfuture.com/karmen-ransomware-variant/