Sponsored By

Chimera Ransomware Trying To Recruit More Operators From Victim Pool

Malware that first appeared in September is now building a ransomware-as-a-service business.

Sara Peters

December 3, 2015

2 Min Read

In a weird twist on Stockholm Syndrome, the Chimera ransomware is taking victims hostage, then recruiting them to be part of the criminal team, according to researchers at Trend Micro's Trend Labs.

Compared to other ransom messages, Chimera's is refreshingly brief, straightforward, and polite: it says "please" twice. What's particularly noteworthy, though is the addition at the bottom:

"Take advantage of our affiliate program! More information in the source code of this file."

The disassembled code does actually contain contact info -- a Bitmessage address through which both parties can have their identities masked and their communication encrypted. From the report:

Peddling ransomware as a service (or RaaS) has some advantages. RaaS lessens the possibility of the illegal activity being traced back to the creators. Selling ransomware as a service allows creators to enjoy some profit without the increased risk of detection. For Chimera, the commission is 50%, a large payoff for lesser effort.

The drawback of the model is that the code itself is less sophisticated -- with a weak command-and-control infrastructure and no obfuscation techniques.

Chimera first appeared on the scene in September, demonstrating another unique tactic -- threatening to publish a victim's files online if payment is not received. The threats, however, might be empty. According to TrendLabs, "our analysis reveals the malware has no capability of siphoning the victim's files to a command-and-control (C&C) server."

It's not uncommon for ransomware to make empty threats. As Engin Kirda, chief architect at LastLine, has told Dark Reading before, some ransomware claims to encrypt files when it can't. Yet, as Michael Sentonas, vice president and chief technology officer of Security Connected for Intel Security, wrote on Dark Reading, "It is not clear if Chimera actually exports your files and can carry out the threat, but if it cannot, the next one will."

About the Author(s)

Sara Peters

Senior Editor

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad of other topics. She authored the 2009 CSI Computer Crime and Security Survey and founded the CSI Working Group on Web Security Research Law -- a collaborative project that investigated the dichotomy between laws regulating software vulnerability disclosure and those regulating Web vulnerability disclosure.


Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights