The digital realm is no stranger to the perils of cyber threats, and among these, ransomware has proven to be one of the most formidable. In August 2022, a new player emerged on the ransomware scene—Qyick Ransomware. As a sophisticated Ransomware-as-a-Service (RaaS), Qyick has been designed to target a broad spectrum of victims, ranging from large enterprises to high-value targets and small to medium-sized businesses (SMBs).
Emergence and Overview of Qyick Ransomware
Qyick Ransomware made its first appearance in the cybercrime landscape in mid-2022, quickly gaining notoriety for its advanced features and potent capabilities. As a RaaS offering, Qyick enables affiliates to lease the ransomware, essentially democratizing the ability to launch ransomware attacks. The programming language of choice for Qyick is Go (Golang), known for its efficiency and performance, which enhances the ransomware’s encryption speed and reliability.
One of the most notable features of Qyick is its support for multiple encryption modes, including a technique known as intermittent encryption. This method speeds up the encryption process and is designed to evade detection by security systems, making Qyick a particularly stealthy form of ransomware.
Technical Profile of Qyick Ransomware
The use of Go as the programming language for Qyick is not a random choice; it enables the ransomware to execute efficiently across different platforms. The intermittent encryption feature that Qyick employs is particularly worrisome for cybersecurity experts. By encrypting only parts of a file’s content, Qyick renders the data unusable without the corresponding decryptor and key, all while reducing the time required for encryption and lowering the likelihood of triggering automated detection tools.
Distribution and Infection Tactics
Qyick’s distribution methods are diverse, with phishing emails and spear-phishing campaigns being the primary vectors for delivering the ransomware payload. Attackers also exploit vulnerable applications and services to gain entry into target networks. Once inside, they might leverage third-party frameworks such as Empire, Metasploit, and Cobalt Strike to move laterally and deploy Qyick across the network.
Creator and Business Model of Qyick
The creator of Qyick, known by the alias ‘lucrostm’, is a recognized entity in the cybercrime world, with a history of developing and selling remote access tools and malware loaders. Qyick’s business model is based on a one-time purchase, with prices ranging from 0.2 to 1.5 BTC, reflecting the cryptocurrency’s role in the ransomware economy. This pricing structure also includes a security guarantee—if Qyick is detected within the first six months, the buyer is entitled to receive a new sample at a discounted rate.
Detection, Mitigation, and Removal
To combat threats like Qyick, SentinelOne offers its Singularity XDR Platform, a solution designed to detect, mitigate, and remove ransomware infections. The platform’s advanced detection capabilities help identify risks associated with Qyick, while its mitigation strategies can neutralize the threat. In the event of an infection, SentinelOne’s platform can also provide rollback capabilities for encrypted files, reversing the damage and restoring data integrity.
The Intermittent Encryption Tactic
The adoption of intermittent encryption is a trend that’s gaining traction among ransomware developers. SentinelLabs has reported on this trend, noting that it not only speeds up the encryption process but also exhibits lower intensity of file IO operations. This makes it harder for detection systems to spot the ransomware as it damages files. Qyick’s intermittent encryption feature is a selling point for the ransomware, attracting affiliates with the promise of unmatched speed and effectiveness.
Adoption of Intermittent Encryption by Other Ransomware Groups
Qyick is not the only ransomware to utilize intermittent encryption; other groups such as Black Basta, ALPHV (BlackCat), PLAY, and Agenda have also adopted this method. Each group implements intermittent encryption in a unique way, catering to their specific operational needs and targets. For instance, BlackCat provides operators with various byte-skipping patterns, while PLAY ransomware, which attacked Argentina’s Judiciary of Córdoba, employs a fixed method to encrypt chunks of files.
The growing adoption of intermittent encryption by ransomware groups signifies a shift in tactics that aims to outpace security measures and maximize the impact of attacks. As these groups continue to innovate, it is crucial for cybersecurity defenses to evolve in response.
Cryptocurrency and the Ransomware Economy
The ransomware economy is intricately linked to cryptocurrencies like Bitcoin (BTC) due to their pseudo-anonymous nature, which provides a veil of privacy for cybercriminals. Qyick’s pricing structure, based on Bitcoin, is indicative of this trend. The use of cryptocurrency in ransomware transactions such as those demanded by Qyick presents significant challenges in tracing and combating these financial flows. The promise of a discount for a new sample upon detection could further drive the demand for cryptocurrencies, as cybercriminals might need to acquire more BTC for future purchases or upgrades.
Impact on Cybersecurity and Countermeasures
The implications of ransomware like Qyick on cybersecurity are profound. Intermittent encryption, as a growing trend, presents new challenges for detection systems, which must now adapt to catch ransomware that operates below traditional thresholds of file IO operations. The role of advanced cybersecurity solutions, such as those provided by SentinelOne, is becoming increasingly critical in protecting against ransomware. By reducing the success rate of attacks, these solutions can potentially impact the cybercrime economy, making it less profitable for attackers to continue developing and distributing ransomware.
Case Studies and News Events
Real-world attacks underscore the threat posed by ransomware utilizing intermittent encryption. The PLAY ransomware attack on Argentina’s Judiciary of Córdoba serves as a stark reminder of the disruption such attacks can cause. Similarly, the Black Basta ransomware chooses its encryption method based on file size, showcasing an adaptive approach to maximize efficiency. These cases highlight the need for robust security measures and the importance of staying ahead of ransomware trends.
Future Developments and Concerns
Looking ahead, there are concerns that Qyick and other ransomware families will continue to evolve. Future versions of Qyick are expected to include data exfiltration capabilities, adding another layer of threat to its arsenal. As ransomware threats become more sophisticated, it’s imperative for organizations to prepare for these evolving challenges. This includes adopting comprehensive cybersecurity strategies, staying informed about the latest ransomware trends, and implementing best practices for prevention and response.
Conclusion
Qyick Ransomware represents a significant evolution in the cybercrime arena, with its use of intermittent encryption and RaaS model posing new challenges for cybersecurity experts. The adoption of such techniques by Qyick and other ransomware groups indicates a shift towards more elusive and efficient attack methods. As the cybersecurity community continues to combat these threats, the importance of advanced detection, mitigation, and recovery solutions cannot be overstated.
EN 
TR