A ransomware stem based on the Hidden Tear ransomware open source, which infects users, encrypts their files without holding the encryption key, rendering all the files irreparably useless.
Last August, Otku Sen's Turkish security team gave GitHub an open-source ransomware code for educational purposes.
This particular ransomware was named Hidden Tear and according to the manufacturer in one article states that he was a honeypot who was trying to trick the other ransomware manufacturers and members of his team to use his code instead of creating one of their own.
The trick was that Hidden Tear contained a crypto code that allowed the researcher to decipher the files later if someone ever used his password.
According to her security team Trend Micro, someone created a Hidden Tear ransomware that the company named RANSOM_CRYPTEAR.B.
Between 15 September and 17 December, a group attacked and broke a website from Paraguay and used it to redirect its users to a fake website designed with Adobe Flash, but sent users a ransomware-wrapped update of Flash Player.
Users who uploaded this update (in order to properly view the bogus website) saw the file running immediately after the download was completed and in a few minutes they were infected with a crypto-ransomware files with their data .
The bad thing was that the ransomware authors somehow managed to hack the Hidden Tear code, and delete the encryption key without first sending it to their C&C servers.
Of course the files of the foolish user had no importance for the authors of the ransomware, who were most interested in taking Bitcoin ransoms (asking for about $ 500 US dollars) than providing a safe way for the user to decrypt his encrypted files after the ransom payment.
Although the Otku Sen team had put Hidden Tear on a secret backdoor in the encyrption algorithm, it was totally useless if the encryption key was deleted.
With regard to badly encrypted ransomware, this is not the first case. Last November, a version of the ransomware Power Worm was also able to lose the encryption key and permanently lock the user's files.
Dimitris hates Mondays...
