Rakhni
Rakhni is a type of malware that has been active since at least 2013. It is known for its versatility, as it can function as both ransomware and a cryptocurrency miner. This dual functionality allows it to adapt its behavior based on the target system's configuration and resources. Rakhni primarily targets Windows operating systems and has been distributed through various methods, including phishing emails and malicious attachments. As of October 2023, cybersecurity researchers continue to monitor Rakhni due to its evolving tactics and persistent threat to users and organizations.
Overview
Rakhni is a malware family that can operate as either ransomware or a cryptocurrency miner. It first emerged in 2013 and has since undergone several updates to enhance its capabilities and evade detection. The malware's ability to choose between encrypting files for ransom or mining cryptocurrency makes it particularly dangerous. It typically targets Windows systems and is distributed through phishing campaigns that use malicious attachments to infect victims' devices.
History
Rakhni was first identified in 2013. Over the years, it has evolved to include new features and techniques to bypass security measures. Initially, Rakhni functioned solely as ransomware, encrypting victims' files and demanding payment in exchange for decryption keys. However, as cryptocurrency mining became more profitable, Rakhni's developers added mining capabilities to the malware. This allowed Rakhni to exploit infected systems for cryptocurrency mining if the system's resources were deemed sufficient.
Technical characteristics
Rakhni's dual functionality is one of its defining characteristics. Upon execution, the malware assesses the infected system's configuration to determine whether to deploy ransomware or a cryptocurrency miner. If the system has adequate resources, Rakhni may opt to mine cryptocurrencies such as Bitcoin. Otherwise, it proceeds to encrypt files and demand a ransom. Rakhni employs various techniques to evade detection, including the use of digital certificates to appear legitimate and the ability to disable security software.
Infection vector
Rakhni is primarily distributed through phishing emails that contain malicious attachments. These attachments often appear as legitimate documents, such as invoices or job applications, to entice users into opening them. Once opened, the attachment executes a script that downloads and installs the Rakhni malware onto the victim's system. The malware may also spread through compromised websites and drive-by downloads, where users unknowingly download the malware by visiting infected sites.
Notable campaigns
Rakhni has been involved in several notable campaigns over the years. One significant campaign occurred in 2018, where the malware was distributed through a large-scale phishing attack targeting Russian-speaking users. The emails contained malicious attachments disguised as financial documents. In another campaign, Rakhni targeted organizations in the healthcare sector, exploiting their reliance on digital records to demand higher ransoms.
Detection and mitigation
Detecting Rakhni involves monitoring for unusual system behavior, such as unexpected file encryption or increased CPU usage indicative of cryptocurrency mining. Security software can help identify and block Rakhni by recognizing its known signatures and behaviors. To mitigate the risk of infection, users and organizations should implement robust email filtering systems, educate employees about phishing threats, and regularly update their software and security measures. Regular backups of critical data can also help recover files without paying a ransom in the event of an infection.