Nuclear Ransomware

The Nuclear Ransomware is an update of the BTCWare Ransomware, a Trojan that blocks your PC's files to force you into paying Bitcoins for restoring them. No public decryptors are available for the Nuclear Ransomware, whose family uses a secure encoding method, and malware experts advise that PC users back up any digital content that's not disposable. Minding password security protocols and having anti-malware programs for removing the Nuclear Ransomware are two of the top defenses that are effective against this Trojan and its family.

Old Trojan Families Go Nuclear

The BTCWare Ransomware family has many members already, likely owing to its use on the black market as a Ransomware-as-a-Service (or RaaS) style product. These variants, like the Blocking Ransomware, the Aleta Ransomware, the OnyonLock Ransomware, or the Nuclear Ransomware, provide consistent attacks that use a double-algorithm encryption and accompanying Web page-based ransom notes largely. However, with their newest Nuclear Ransomware, the responsible threat actors appear to be making changes that make decrypting a victim's files even harder than previously.

The Nuclear Ransomware encrypts media on the victim's computer after gaining access to it through any means the 'renting' threat actor considers preferable, such as email attachments or brute-force hacking of network servers. When running, the Nuclear Ransomware enciphers local files such as documents or pictures with an AES-based cipher and protects the generated key with another layer of the RSA encoding. It also injects the secondary threat actor's email address (such as 'black.world@tuta.io') for ransom negotiations into the name, following it up with a '.nuclear' extension.

The Nuclear Ransomware's HTA-formatted ransom messages also are similar to the latest versions of instructions this family uses, with offers of decrypting three files for free and demanding Bitcoins for unlocking everything else. In the past, malware analysts saw threat actors associated with the programming side of the Nuclear Ransomware providing free releases of decryption keys for outdated variants of the BTCWare Ransomware family; however, with the Nuclear Ransomware, that no longer appears to be their SOP. Victims may or may not have access to decryption solutions for any media that the Nuclear Ransomware locks, in the future.

The Personal Prevention of Nuclear Proliferation

Threat actors deploying variants of the Nuclear Ransomware's family often gain remote control over a PC after they compromise passwords and related login credentials, which is possible through brute-force applications. Sophisticated and unconventional passwords can reduce the chance of such hacking tools breaking into a server. Victims dealing with the Nuclear Ransomware infections should remain alert to the possibility of a remote attacker using RDP exploits for committing additional attacks, such as disabling security features or installing a backdoor Trojan.

A public decryptor for the Nuclear Ransomware may or may not be possible, in the future, but the only immediate solutions for restoring any blocked media include recovering from a backup or paying the threat actors for their decryption help. Malware experts recommend that business entities most likely of being targets of the Nuclear Ransomware store their backups in secure locations that can't be encrypted or deleted during an infection particularly. Although most anti-malware programs may uninstall the Nuclear Ransomware or other variants of the BTCWare Ransomware, doing so doesn't decode any locked work data.

RaaS business strategies are relatively easy ways for con artists to organize the distribution and development of Trojans in a manner that makes profiting as efficient as possible. Until it stops being lucrative, workers will need to stay on top of both their network security protocols and their backup routines.

Technical Details