Since its emergence earlier this year, the Cicada3301 ransomware group has established itself as a prominent threat to UK businesses and critical infrastructure, suppoesedly publishing data from 30 companies on its dedicated leak sites.

Written in Rust, the ransomware’s cross-platform capabilities allow it to target a wide range of systems, including Windows, Linux, ESXi, and less common architectures like PowerPC. Its dual-layer encryption method utilises ChaCha20 and RSA, supporting different modes (Full, Fast, and Auto) to optimise the impact based on file sizes and extensions.

The group’s affiliate program is a key factor in its success, attracting penetration testers and access brokers with a commission-based model. Affiliates receive 20% of ransom payments and gain access to an advanced web-based panel for customising attacks. This platform enables the generation of ransomware samples, ransom note creation, and management of victim negotiations, giving affiliates substantial control over their operations.

Cicada3301’s ransomware exhibits aggressive tactics, such as terminating critical services, disabling system recovery, and encrypting network shares. It also has the capability to shut down virtual machines to amplify disruption. The group adopts a strategy of data exfiltration before encryption, using the threat of data leaks as leverage to compel ransom payments.

The rapid emergence of Cicada3301 can be partly linked to similarities in code with the defunct BlackCat ransomware, suggesting a shared origin or adaptation of tactics.

Recommended reading

• 75% of Organisations Hit by Ransomware More Than Once
• Half of Cybersecurity Professionals Expect to Burnout Within the Next Year
• UK Businesses Face New Cyber-attacks Every 44 Seconds in Q2 2024

Despite its early success, there remains a significant gap between the potential of Cicada3301’s ransomware and its widespread adoption, with many affiliates still in the nascent stages of utilising its tools. This group’s approach reflects the broader trend of ransomware-as-a-service (RaaS), offering a turnkey solution for cybercriminals to launch sophisticated attacks.

To mitigate against the risk presented by groups like Cicada3301, organisations much employ tools such as multi-factor authentication, early detection, proper backup strategies and regular patching.