{"id":3461,"date":"2021-10-19T19:47:42","date_gmt":"2021-10-19T14:17:42","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=3461"},"modified":"2021-10-19T19:47:43","modified_gmt":"2021-10-19T14:17:43","slug":"new-karma-ransomware-gang-likely-a-nemty-rebrand","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/","title":{"rendered":"New Karma Ransomware Gang likely a Nemty Rebrand"},"content":{"rendered":"\n
Security investigators discover the clues of the Karma ransomware existence just another development procedure in the anxiety that initiated as JSWorm, turn into Nemty, then Nefilim, Fusion, Milihpen, and most recently, Gangbang.<\/p><\/p>\n\n\n\n
The identify Karma has been used by ransomware actors back in 2016, but there is no connection between that gang and the one that appeared this year. JSWorm initially came into the view in 2019, and went through a series of rebrands over the next two years, while always retaining code similarities that were enough for researchers to make the connection.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
Correlations Expanded and Deep<\/strong><\/h2>\n\n\n\n
The report is based on the examination of eight samples taken from an equal number of ransomware attacks in June 2021, all having notable code similarities to Gangbang and Milihpen variants that come up around January 2021.<\/p><\/p>\n\n\n\n
The extent of similarities ranges to the exclusion of folders, file types, and the debug messages used by the seemingly unrelated strains.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
Another noteworthy similarity can be spotted when conducting a \u201cbindiff\u201d on Karma and Gangbang samples, seeing an almost unchanged \u2018main()\u2019 function.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
From the perspective of the encryption scheme used, there has been an evolution across the samples, with the earlier ones using the Chacha20 encryption algorithm and the most recent samples switching to Salsa20.<\/p><\/p>\n\n\n\n
Another change that was introduced along the way was to create a new thread for the enumeration and the encryption, possibly to achieve a more reliable outcome.<\/p><\/p>\n\n\n\n
The authors of the malware have also added support for command line parameters on the latest versions.<\/p><\/p>\n\n\n\n
All in all, the work on the malware and the tight compilation dates of the analyzed samples reflect the fact that Karma is currently under active development.<\/p><\/p>\n\n\n\n
In terms of victim communication and the corruption method, Karma follows the typical approach of dropping ransom notes, stealing data from compromised systems, and following up for a double-extortion process.<\/p><\/p>\n\n\n\n
Historically, Nemty targeted mostly Chinese firms in the engineering and manufacturing sector, leveraging exposed RDPs and published VPN exploits to infiltrate vulnerable networks.<\/p><\/p>\n\n\n\n
Karma Could be a Limited rebrand<\/strong><\/h2>\n\n\n\n
In a private discussion that our experts had with the researcher who signs the analysis, Antonis Therefore, we got the following assessment on Karma\u2019s current state:<\/p><\/p>\n\n\n\n
The Nemty onion leak page \u2018Corporate Leaks\u2019 currently is running on (Onion) version 2 which will be deprecated soon, and the last leak there was observed on the 20th of July. Karma\u2019s leak page was created on the 22nd of May and the first leak happened on the 1st of September.<\/p><\/p>\n\n\n\n
With the modern data at hand, the Karma ransomware and its onion pages resemble to be another rebrand of Nemty and Corporate leaks. Code-wise the main differences appear on the encryption algorithm, which is an area of experimentation for many ransomware authors.<\/p><\/p>\n\n\n\n
Certainly, \u2018Corporate Leaks\u2019 has allowed dormant around the same time that Karma Leaks emerged as the group\u2019s latest information leak portal.<\/p><\/p>\n\n\n\n
Prominently, the current portal has also opened a short period of inactivity lately, with the most recent victim listed there being from 20 days ago. All that said, Karma could be just a short-term station in the restoration of a long-term ransomware performance from an organization that affects to be less than they are.<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"
Security investigators discover the clues of the Karma ransomware existence just another development procedure in the anxiety that initiated as JSWorm, turn into Nemty, then Nefilim, Fusion, Milihpen, and most recently, Gangbang. The identify Karma has been used by ransomware actors back in 2016, but there is no connection between that gang and the one […]<\/p>\n","protected":false},"author":2,"featured_media":3466,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"yoast_head":"\n
New Karma Ransomware Gang likely a Nemty Rebrand - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New Karma Ransomware Gang likely a Nemty Rebrand - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"Security investigators discover the clues of the Karma ransomware existence just another development procedure in the anxiety that initiated as JSWorm, turn into Nemty, then Nefilim, Fusion, Milihpen, and most recently, Gangbang. The identify Karma has been used by ransomware actors back in 2016, but there is no connection between that gang and the one […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-10-19T14:17:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-10-19T14:17:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/New-Karma-Ransomware-Gang-likely-a-Nemty-Rebrand-featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"New Karma Ransomware Gang likely a Nemty Rebrand\",\"datePublished\":\"2021-10-19T14:17:42+00:00\",\"dateModified\":\"2021-10-19T14:17:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/\"},\"wordCount\":539,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Vulnerabilities\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/\",\"url\":\"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/\",\"name\":\"New Karma Ransomware Gang likely a Nemty Rebrand - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2021-10-19T14:17:42+00:00\",\"dateModified\":\"2021-10-19T14:17:43+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"New Karma Ransomware Gang likely a Nemty Rebrand\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New Karma Ransomware Gang likely a Nemty Rebrand - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/","og_locale":"en_US","og_type":"article","og_title":"New Karma Ransomware Gang likely a Nemty Rebrand - Xiarch Solutions Private Limited","og_description":"Security investigators discover the clues of the Karma ransomware existence just another development procedure in the anxiety that initiated as JSWorm, turn into Nemty, then Nefilim, Fusion, Milihpen, and most recently, Gangbang. The identify Karma has been used by ransomware actors back in 2016, but there is no connection between that gang and the one […]","og_url":"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2021-10-19T14:17:42+00:00","article_modified_time":"2021-10-19T14:17:43+00:00","og_image":[{"width":1000,"height":525,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/New-Karma-Ransomware-Gang-likely-a-Nemty-Rebrand-featured-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"New Karma Ransomware Gang likely a Nemty Rebrand","datePublished":"2021-10-19T14:17:42+00:00","dateModified":"2021-10-19T14:17:43+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/"},"wordCount":539,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Vulnerabilities"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/","url":"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/","name":"New Karma Ransomware Gang likely a Nemty Rebrand - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2021-10-19T14:17:42+00:00","dateModified":"2021-10-19T14:17:43+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/new-karma-ransomware-gang-likely-a-nemty-rebrand\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"New Karma Ransomware Gang likely a Nemty Rebrand"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3461"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=3461"}],"version-history":[{"count":1,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3461\/revisions"}],"predecessor-version":[{"id":3467,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3461\/revisions\/3467"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/3466"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=3461"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=3461"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=3461"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"New-Karma-Ransomware-Gang-likely-a-Nemty-Rebrand-image1\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/New-Karma-Ransomware-Gang-likely-a-Nemty-Rebrand-image1-1024x167.png\")
<\/figure><\/div>\n\n\n\n![\"New-Karma-Ransomware-Gang-likely-a-Nemty-Rebrand-image2\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/New-Karma-Ransomware-Gang-likely-a-Nemty-Rebrand-image2-1024x607.jpg\")
<\/figure><\/div>\n\n\n\n![\"New-Karma-Ransomware-Gang-likely-a-Nemty-Rebrand-image3\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/New-Karma-Ransomware-Gang-likely-a-Nemty-Rebrand-image3-1024x404.png\")
<\/figure><\/div>\n\n\n\n