{"id":36259,"date":"2022-09-01T17:22:54","date_gmt":"2022-09-01T14:22:54","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=36259"},"modified":"2026-03-28T01:39:10","modified_gmt":"2026-03-27T22:39:10","slug":"redalert-and-monster-multiplatform-ransomware-gains-steam","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/redalert-and-monster-multiplatform-ransomware-gains-steam\/","title":{"rendered":"RedAlert and Monster: multiplatform ransomware gains steam\u00a0"},"content":{"rendered":"\n

In line with the trend for cross-platform ransomware, Kaspersky has discovered new ransomware gangs that learned to adapt their malware to different operating systems at the same time \u2013 and therefore cause damage to more organizations. The recent investigation by Kaspersky experts uncovered the activity of RedAlert and Monster \u2013 groups that managed to perform attacks on different operating systems without resorting to multiplatform languages. Additionally, the experts described 1-day exploits that may be executed by ransomware groups in order to achieve their financial ambitions.<\/strong><\/p>\n\n\n\n

In 2022, Kaspersky security researchers have been witnessing the prolific use of cross-platform amenities by ransomware groups. These days, they\u2019re aiming at damaging as many systems as possible by adapting their malware code to several OS at the time. Kaspersky has already described groups that used Rust or Golang multiplatform languages \u2013 for example,\u00a0Luna\u00a0or\u00a0BlackCat<\/a>. However, this time the reported ransomware groups deploy malware that is not written in a cross-platform language but still can target various OS simultaneously.<\/p>\n\n\n\n

One group, RedAlert, employs malware written in plain C \u2013 as detected in the Linux sample. However, the malware developed by RedAlert does explicitly support ESXi environments. Moreover, the RedAlert onion website offers a decryptor for download \u2013 unfortunately, there\u2019s no extra data available whether it\u2019s written in the cross-platform language. Another aspect that sets RedAlert apart from other ransomware groups is that they only accept payments in Monero cryptocurrency \u2013 making money harder to trace. Although such an approach might be reasonable from criminals\u2019 point of view, Monero is not accepted in every country and by every exchange so victims might face a problem paying off the ransom.<\/p>\n\n\n\n

Another ransomware group detected in July 2022 is Monster which applies Delphi, a general-purpose programming language, to write their malware that, however, expands on different systems. What makes this group especially peculiar is that it has a graphical user interface (GUI) \u2013 a component that has never been implemented by ransomware groups before. Moreover, cybercriminals executed ransomware attacks through the command line automated during an ongoing targeted attack. According to the sample extracted by Kaspersky experts, the Monster ransomware authors\u00a0included the GUI as an optional command line parameter.\u00a0<\/p>\n\n\n\n

\"https:\/\/lh6.googleusercontent.com\/3TlnuJbWET1-t4djZuqYrVUf0yLaCH9dQTgTjr0x2Nzjb9-CyjsiM4uH7ohdVmfsyRP3xUZPswGCgh4pOViXgd5IP07XyxpsK97inS36r_p0ScXZLxznYgOWkbohm5c7yfaB5MeXtCzyPVD_FeVixw\"\/<\/figure>\n\n\n\n

GUI used by Monster<\/em><\/p>\n\n\n\n

 Monster performed attacks on users in Singapore, Indonesia, and Bolivia.<\/p>\n\n\n\n

The report issued by Kaspersky also covers so-called 1-day exploits used to attack Windows 7-11. The 1-day exploit usually refers to an exploit of an already patched vulnerability and always\u00a0raise a question of patching policy within the affected organization. An example is the\u00a0CVE-2022-24521<\/a>\u00a0vulnerability that\u00a0allows an attacker to gain system privileges on the infected device. It took attackers two weeks after the vulnerability was disclosed in April 2022, to develop the two exploits. Particularly interesting about these exploits is that they support a variety of Windows versions. This usually indicates that the attackers are aiming at commercial organizations. Also, both exploits share many debug messages. One detected case includes attacks on\u00a0a retail chain in APAC region \u2013 however, there\u2019s no extra data on what the cybercriminals were trying to achieve.<\/p>\n\n\n\n

\u201cWe\u2019ve got quite used to the ransomware groups deploying malware written in cross-platform language. However, these days cybercriminals learned to adjust their malicious code written in plain programming languages for joint attacks \u2013making security specialists elaborate on ways to detect and prevent the ransomware attempts. Also, we draw attention to the importance of constant reviewing and updating patch policies that are applied by companies,\u201d <\/em>comments Jornt van der Wiel, a senior security researcher at Kaspersky\u2019s Global Research and Analysis Team.<\/p>\n\n\n\n

To learn more about RedAlert and Monster ransomware groups as well as 1-day exploits, please check the full report on Securelist<\/a>.<\/p>\n\n\n\n

To protect yourself and your business from ransomware attacks, consider following the rules proposed by Kaspersky:<\/p>\n\n\n\n