GoodWill is a ransomware strain that asks victims to carry out social good activities, instead of paying a ransom, to get a decryption key. According to the post it is written in .NET and is based on the open-source HiddenTear ransomware. Researchers who analyzed it attribute the attack to a threat actor based in India.
What Is GoodWill Ransomware?
A ransomware group that solicits donations from targets to individuals and patients who need help in exchange for a decryption tool has been identified by security researchers. Ransomware called GoodWill was detected in March 2022. As the threat group’s name suggests, operators are allegedly more interested in promoting targets for social justice than traditional financial motivations. Some of the features identified by GoodWill in the analyzes are as follows;
- GoodWill ransomware was developed with .NET and packaged with UPX wrappers.
- It can stay in sleep mode for 722.45 seconds to avoid being detected during dynamic analysis.
- It uses the AES_Encrypt function to encrypt the captured files with the AES algorithm.
- It has a function called “GetCurrentCityAsync” that tries to detect the geolocation of the infected system.
How Is GoodWill Linked to HiddenTear?
In the detailed analysis of GoodWill carried out by threat intelligence researchers, it has been observed that the ransomware in question is based on the open-source HiddenTear ransomware software. In addition, the use of Hindi scripts by threat actors in the existing lines leads to the opinion that the group is based in India.
What Harm Does GoodWill Cause?
Although the threat actors behind the GoodWill ransomware software claim to operate under the name of social responsibility campaigns, they violate the intellectual property and privacy concepts of institutions/organizations. At the same time, these activities cause the targeted organizations to be unable to provide services, damage their reputation, material, and moral losses, and violate the security of personal information.
How Can You Protect Yourself?
To not be the target of similar attacks in this context, it is recommended that email, attachments, and links from unknown parties are not respected, and input information used in accounts is created using unique and powerful policies. Also, it is important to use comprehensive security solutions and enable 2FA/MFA features on all possible platforms.