Venus ransomware target publicly exposed Remote Desktop services

A relatively new ransomware operation, identified as Venus, hacks into publicly exposed Remote Desktop services to encrypt Windows devices. According to researchers, Venus ransomware started operating in the middle of August 2022 and has since encrypted victims all over the world.

As soon as it is executed, Venus ransomware tries to terminate thirty-nine processes that are connected to database servers and Microsoft applications. The ransomware then continues to delete event logs, Shadow Copy Volumes, and disable Data Execution Prevention through an identified command.

When encrypting files, the ransomware appends the .venus extension. In each encrypted file, the ransomware will add a ‘goodgamer’ filemarker and other information to the end of the file. However, it remains unclear what this stands for.

Venus ransomware creates an HTA ransom note in the %Temp% folder, which is automatically displayed when the ransomware is ready to encrypt the device.

The analysis of the ransom note seen shows that the ransomware identified as “Venus” and shared a TOX address and email address, which can be used to reach the threat actor to negotiate a ransom payment. At the end of the ransom note is a Base64 encoded blob, which is probably the encrypted decryption key.

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web