April 26, 2021 By David Bisson 2 min read

Most ransomware actors are in it for the money. But, that doesn’t appear to be the case for whoever created the ‘Hog’ crypto-malware strain.

Instead, Hog’s operators informed at least some of their victims that they’ll restore the affected files if those victims agree to join their Discord server. Read on to learn how this new ransomware verifies whether a victim has complied with this unusual data security problem.

A Discord User Token for All

The encryptor used by Hog began by checking to see if a certain Discord server existed. If this check came back positive, the ransomware strain proceeded to encrypt a victim’s files. It appended the .hog extension to the file names of all of the affected files and extracted its decryptor feature. It then automatically ran this decryption utility from the Windows Startup folder after completing its encryption routine.

The ‘Hog Ransomware Decryptor’ component informed a victim that the malware had encrypted their files using AES-256. It went on to tell them that they could recover their files if they agreed to join their Discord server. They could do this using a Discord account token shared by the component.

By handing out tokens, the ransomware attackers ensured that they could authenticate themselves to Discord’s application programming interface as their victims. They could use that process to confirm whether the victims had indeed joined their server.

If the victim complied, the Hog Ransomware Decryptor feature proceeded to decrypt the victim’s files. The ransomware would do this even if it failed to confirm the existence of the attackers’ server.

A Growing Preference for Discord Among Ransomware Actors

Hog isn’t the first malware family that’s leveraged Discord in some way. Threat actors misused the Discord content delivery network (CDN) to target others — even non-Discord users — with a variety of threats in February, according to Zscaler. People who do have accounts also face other Discord security issues, such as a 2019 Discord phishing attack.

One of those instances involved a loader that dropped a sample of Epsilon onto a victim’s machine. In that attack, the ransomware strain established persistence, then encrypted a victim’s files. After completing its encryption routine, Epsilon then used Discord’s CDN network as a command-and-control server. Through this, it downloaded its ransom note along with an image of that message to function as a victim’s desktop wallpaper.

Trend Micro discovered two new ransomware families in March. One of those threats, dubbed ‘Humble’, used a public webhook from Discord in order to establish communication with its handlers. It also leveraged the webhook to publish infection reports pertaining to its victims.

How to Defend Against Hog

The analysis published by Bleeping Computer didn’t mention how Hog’s operators distribute it. With that said, the best way for organizations to currently protect themselves against Hog is to follow general ransomware prevention steps. Those measures include building a positive security culture. Invest in a security awareness training program, which makes sure employees are familiar with phishing attacks and other common vectors for ransomware.

In addition, you might consider putting technical controls in place designed to limit the impact of a successful ransomware infection. For instance, user behavior analytics can spot a potential account compromise, security policies can prevent the data theft and data backups can restore systems in the event of an infection or other application security problem.

More from News

What is the Open-Source Software Security Initiative (OS3I)?

3 min read - The Open-Source Software Security Initiative (OS3I) recently released Securing the Open-Source Software Ecosystem report, which details the members’ current priorities and recommended cybersecurity solutions. The accompanying fact sheet also provides the highlights of the report. The OS3I includes both federal departments and agencies working together to deliver policy solutions to secure and defend the ecosystem. The new initiative is part of the overall National Cybersecurity Strategy. After the Log4Shell vulnerability in 2021, the Biden-Harris administration committed to improving the security…

Europe’s Cyber Resilience Act: Redefining open source

3 min read - Amid an increasingly complex threat landscape, we find ourselves at a crossroads where law, technology and community converge. As such, cyber resilience is more crucial than ever. At its heart, cyber resilience means maintaining a robust security posture despite adverse cyber events and being able to anticipate, withstand, recover from and adapt to such incidents. While new data privacy and protection regulations like GDPR, HIPAA and CCPA are being introduced more frequently than ever, did you know that there is new…

Feds release urgent guidance for U.S. water sector

3 min read - The water and wastewater sector (WWS) faces cybersecurity challenges that leave it wide open to attacks. In response, the CISA, EPA and FBI recently released joint guidance to the sector, citing variable cyber maturity levels and potential cybersecurity solutions. The new Incident Response Guide (IRG) provides the water sector with information about the federal roles, resources and responsibilities for each stage of the cyber incident response lifecycle. Sector owners and operators can use this information to augment their incident response…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today