Security researchers from the BlackBerry Research and Intelligence Team along with KPMG’s U.K. Cyber Response Services have discovered a new form of ransomware that’s being used by attackers.

Dubbed “Tycoon,” the ransomware is uniquely Java-based and targets both Windows and Linux systems. Believed to have been first used in December, Tycoon leverages an obscure Java image format to fly under the radar.

Those behind Tycoon have been observed to be targeting small to medium-sized companies and institutions in education and software industries, where they would proceed to encrypt file servers and demand a ransom.

To achieve persistence on a victim’s machine, the attackers use a technique called Image File Execution Options injection, a setting that in Windows is designed to allow developers to debug software. The ransomware then opens a backdoor that is executed alongside the Microsoft Windows On-Screen Keyboard feature.

The Tycoon ransomware also disables a victim’s anti-malware solutions with the use of the ProcessHacker utility and changes the passwords for Active Directory services leaving the victim unable to access their systems.

Once it has taken control of a targeted computer, Tycoon encrypts files using a so-called AES-256 algorithm in Galois/Counter mode with a 16-byte long GCM authentication tag to ensure data integrity. That sounds bad but there is some good news: Those behind the attack use a common RSA private key that is publicly available. Victims can, with some effort, unencrypt their files.

The researchers note that while Tycoon has been active since December, the fact that it has sailed under the radar until now is due the attacks using the ransomware being highly targeted.

“Malware writers are constantly seeking new ways of flying under the radar,” the researchers wrote. “They are slowly moving away from conventional obfuscation and shifting towards uncommon programming languages and obscure data formats. We have already seen a substantial increase in ransomware written in languages such as Java and Go. This is the first sample we’ve encountered that specifically abuses the Java JIMAGE format to create a custom malicious JRE build.”

Photo: Udo Grimberg/Wikimedia Commons