# Thanos Ransomware : Prepare The Gauntlet 

**URL:** <https://onehack.st/t/thanos-ransomware-prepare-the-gauntlet/92244>\
**Category:** News & Articles\
**Tags:** hacking, news\
**Created:** [June 15, 2020, 10:35pm UTC](https://onehack.st/t/thanos-ransomware-prepare-the-gauntlet/92244 "2020-06-15T22:35:07Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![fd2013](https://onehack.st/user_avatar/onehack.st/fd2013/32/85616_2.png) [@fd2013](https://onehack.st/u/fd2013)\
**Post date:** [June 15, 2020, 10:35pm UTC](https://onehack.st/t/thanos-ransomware-prepare-the-gauntlet/92244/1 "2020-06-15T22:35:07Z")

</div>

![download (1)](https://onehack.st/uploads/default/original/3X/7/f/7f8a0dbdad5a5da3e6cd315e01abc0371462f053.jpeg)

# Thanos, a new Ransomware-as-a-Service (RaaS) tool, is gaining immense popularity in underground forums.

 ![download](https://onehack.st/uploads/default/original/3X/9/8/9854a722ec3c0eb4b2d751251e58359540efba1a.jpeg)

### What is going on

Thanos has been discovered to be the sole ransomware family, to date, to use the researcher-disclosed [RIPlace tactic](https://www.nyotron.com/riplace/). RIPlace is a Windows file system technique that can be used to maliciously alter files and allow threat actors to bypass anti-ransomware methods.

### Know your history

- The distribution of Thanos first started at the end of October 2019 and was known as [Quimera ransomware](https://www.bleepingcomputer.com/forums/t/711019/quimera-crypter-chimera-pashka-ransomware-support-topic/).
- By early 2020, it started being identified as [Hakbit](https://www.bleepingcomputer.com/forums/t/721616/hakbit-ransomware-crypted;-help-me-recover-my-filestxt-support-topic/), based on core functionality, string reuse, and code similarity.
- In a [new report](https://go.recordedfuture.com/hubfs/reports/cta-2020-0610.pdf), the ransomware was finally identified as Thanos which is being promoted as a RaaS on Russian hacker forums, since February.
- The discovery of Thanos coincided with a [25% surge](https://www.law360.com/cybersecurity-privacy/articles/1281367/ransomware-hits-soar-with-no-relief-in-sight-insurer-says) in total ransomware attacks in the first three months of 2020, compared to the final three months of 2019.
- Since the last six months, the operators have been tweaking their software, leading to 12-17 [classes of malware](https://www.cyberscoop.com/thanos-ransomware-testing-recorded-future/).

### Worth noting

- The Thanos client is written in C#.
- The client uses AES-256 in CBC mode to [encrypt](https://www.recordedfuture.com/thanos-ransomware-builder/) user files.
- Thanos client also offers [lateral-movement function](https://threatpost.com/thanos-ransomware-weaponize-riplace-tactic/156438/#:~:text=Thanos%20is%20the%20first%20ransomware,popularity%20in%20multiple%20underground%20forums.), which leverages SharpExe.

### The bottom line

It is believed that the ransomware will continue to be weaponized by its operators in different ways. Moreover, while Carbon Black and Kaspersky updated their software post-disclosure of the latest technique used by Thanos, some [organizations](https://www.bleepingcomputer.com/news/security/new-riplace-bypass-evades-windows-10-av-ransomware-protection/) are yet to take the step. However, with the best security practices, companies can avert this ransomware strain.

```
Source : cyware

```