According to a recent report by Uptycs, the threat actor responsible for this ransomware-as-a-service actively promotes their offering on various forums. They request a share of the profits generated by those who employ their malware for malicious activities.
Cyclops ransomware stands out for its capability to target major desktop operating systems, including Windows, macOS, and Linux. It is specifically designed to terminate any processes that could potentially interfere with its encryption process.
The macOS and Linux variants of Cyclops ransomware are coded in the Go programming language (Golang). This ransomware employs a complex encryption scheme that combines both asymmetric and symmetric encryption techniques.
As for the Go-based information stealer, it is designed to target Windows and Linux systems, collecting details such as operating system information, computer name, the number of processes running, and files with specific extensions considered of interest.
The harvested data, which includes files with extensions like .TXT, .DOC, .XLS, .PDF, .JPEG, .JPG, and .PNG, is then uploaded to a remote server. Customers can access the information-stealing component via an admin panel.
This development coincides with SonicWall's disclosure of a new strain of information stealer called Dot Net Stealer. This malware is capable of siphoning data from web browsers, VPNs, installed applications, and cryptocurrency wallets. It represents an evolution in the cybercrime landscape, posing a more significant threat to victims.
SonicWall notes that these capabilities empower attackers to obtain valuable information from victims' systems, potentially leading to substantial financial fraud and significant financial losses for the victims.