Linux.Encoder

Linux.Encoder.1 is considered as the first Ransomware Trojan targeting computers running Linux. Discovered on November 6, 2015, by Dr. Web, this malware affected more than 2,000 Linux users.

Linux.Encoder.1 is remotely executed on the victim's computer by using a flaw in Magento, a popular Content_management_system app. When activated, the malware encrypts certain types of files stored on local and mounted network drives using AES and RSA Public-key_cryptography, with the private key stored only on the malware's control servers. The malware then store a file called "readme_to_decrypt.txt" in every folder. The message which offers to decrypt the data if a payment (through Bitcoin) is made. Compared to other ransomware such as CryptoLocker, the malware does not state a deadline to pay and the ransom does not increase over time.

Discovery

On November 5, 2015, Dr. Web, a Russian anti-malware company added to its virus database Linux.Encoder.1. The company then published the malware description the day after. This ransomware is written in C using the PolarSSL library.

Operation

Propagation

According to Bitdefender Labs, the most common infection vector is though a flaw in Magento, a shopping cart software. CheckPoint, reported this vulnerability in April 2015. After this report, Magento issued a fix. However, a lot of small ecommerce site did not apply this critical update. Linux host might also be attacked using other exploits.