Technical Analysis of CryptNet Ransomware

Key Points

CryptNet is a new ransomware-as-a-service that has been advertised in underground forums since at least April 2023
The CryptNet threat group claims to perform double extortion attacks by combining data exfiltration with file encryption
The ransomware code is written in the .NET programming language
CryptNet uses 256-bit AES in CBC mode and 2048-bit RSA to encrypt files
The CryptNet ransomware codebase is closely related to Chaos ransomware

Zscaler ThreatLabz has been tracking a new ransomware group known as …

aes analysis april as-a-service attacks claims code data data exfiltration double extortion encryption exfiltration extortion file file encryption forums key key points language mode programming programming language ransomware service technical technical analysis threat threat group underground