JungleSec ransomware – IPMI exploit removal

JungleSec ransomware, a unique infection capable of impacting different operating systems, is on the rise, so here’s a heads-up on this new crypto threat.

The ransomware climate has been generally dull lately, with lookalike blackmail cyber-pests splashing onto the scene and vanishing shortly afterwards without leaving any noteworthy footprint. The one called JungleSec is a rare exception, though. What makes it stand out in the first place is the platform coverage. Whereas the overwhelming majority of file-encrypting viruses are Windows-only, this pest additionally supports Linux and Mac. Furthermore, it primarily zeroes in on servers rather than desktop computers, so it is primarily a headache of system admins. Yet another distinguishing feature of the JungleSec ransomware is the very peculiar distribution technique bolstering its adverse success. The architects of this campaign, which has been underway since about November, execute the perpetrating code on target machines manually. This is possible due to the exploitation of improperly secured or misconfigured IPMI (Intelligent Platform Management Interface) devices.

For the record, IPMI is a management console allowing system administrators to perform a number of maintenance and control activities with servers manually. Some of the options include turning the equipment on or off, retrieving system statistics, and accessing KVM (kernel-based virtual machines), to name a few. The interface in question can be either embedded in server motherboards or installed as a separate extra module. Given the indisputable convenience of the remote access functions, these consoles are used in numerous Internet-facing server set-ups. The flip side of this handiness is that cybercriminals have managed to find loopholes in their security. Although the entirety of entry points haven’t been unveiled at this point, one of the possible attack vectors comes down to the use of default IPMI access credentials. It’s also within the realms of possibility that the malefactors have been harnessing some zero-day vulnerabilities of said interface to infiltrate Linux, Windows, and Mac systems and run the malicious program.

Once JungleSec is in, it scans all disks for potentially valuable files. Interestingly, it may even attempt to scour virtual machine drives in the same way. Every data element spotted during this stealth traversal is subject to encryption with ccrypt, a cross-platform solution leveraging the Rijndael block cipher to securely encode files and streams. Upon completion of the crypto procedure, the ransomware stains all the locked-down files with the .jungle@anonymousspechcom or .cpt extension. It also drops a ransom notification named ENCRYPTED.md (see above). This Markdown document in plaintext format gives the victim some initial clues on what happened and how to sort things out. It says all data has been encrypted and warns the infected user about irreversible loss of the information in case they attempt to brute-force the decryption key, change filenames or alter the current path.

The attackers’ way of recovering the hostage files is all about ransom. They instruct the victim to send 0.3 Bitcoin (worth about $1,100 at the time of writing) to a BTC address indicated in the ENCRYPTED.md note. As soon as the payment is made, the user is supposed to contact the felons at junglesec@anonymousspeech.com and include the IP address of their server or computer in this message. In response, the extortionists will allegedly send the details of the recovery process within 24 hours. However, although quite a few victims have reportedly paid up, they never got any decryption steps in return. The takeaway is to refrain from submitting the ransom – while this is a standard recommendation of security experts, it is particularly relevant in this scenario. Some of the worthwhile data recovery tips backed by commonplace forensics might turn out much more effective than expecting the adversary to stay true to their promises.

JungleSec ransomware automated removal and data recovery

When faced with ransomware like JungleSec, one of the best shortcuts in terms of removal is to use Combo Cleaner, a lightweight and incredibly effective application with PC security and optimization features under the hood. It detects and thoroughly deletes threats while giving you insights into the overall health of your computer.

This program’s protection power spans modules that forestall all known types of malware, including ransomware and browser hijackers, and take your online security to the next level by blocking phishing sites and other suspicious web pages. Follow these simple steps to eliminate the infection for good:

1. Download Combo Cleaner installer.

Download JungleSec remover

^{Combo Cleaner scans your PC with no strings attached, but you’ll have to buy its fully functional version to remove the threats it detects. The disk optimization tools that find large files and duplicates are free to use.}

2. Open the CCSetup.exe file to get started. Several subsequent screens will allow you to make initial customizations so that the program works exactly as you need from the get-go.

3. The installation will be followed by an update of malware signatures. Once this process is through, click the Start Scan button in the left-hand sidebar.

4. Combo Cleaner will then check system locations that are most often polluted by Windows malware. The first scan can take a while to finish.

5. Combo Cleaner will display a system tray notification as soon as the scan is over. Click the Resolve found threats button to view the results.

6. The scan summary shows the names and types of the detected threats as well as their statuses and locations. Click the Remove all threats button and follow further on-screen prompts to get rid of these items.

Data recovery toolkit to the rescue

Some strains of ransomware are known to delete the original files after the encryption routine has been completed. As hostile as this activity appears, it can play into your hands. There are applications designed to revive the information that was obliterated because of malfunctioning hardware or due to accidental removal. The tool called Stellar Data Recovery features this type of a capability and therefore it can be applied in ransom attack scenarios to at least get the most important files back. So use the app to get an idea of what data can be restored and let it do the recovery job. Here is a step-by-step walkthrough:

1. Download and install Stellar Data Recovery.

Download Stellar Data Recovery

2. Open the application, select the types of recoverable files to look for, and click Next.

3. Choose the areas you want the tool to recover from and click the Scan button.

4. Having scanned the specified locations, the program will display a notification about the total amount of recoverable data. Close the dialog and click the Recover button. This will hopefully help you get some of your valuable files back.

JungleSec ransomware manual removal and file recovery

Some ransomware strains terminate themselves after completing the encryption job on a computer, but some don’t. Furthermore, the JungleSec virus may prevent victims from using popular antimalware tools in order to stay on board for as long as possible. Under the circumstances, it may be necessary to utilize the Safe Mode with Networking or System Restore functionality.

Be advised that even after the ransomware is removed, files will still be encrypted and inaccessible. The malicious code cleanup part, however, is important because it keeps a relapse of the infection from occurring further on and eliminates all opportunistic malware.

Ways of non-ransom recovery of files encrypted by JungleSec ransomware

Cracking the crypto used by this ransom Trojan is more of a science fiction thing rather than an attainable prospect for the masses. This is why the troubleshooting in predicaments of this sort is a matter of two approaches: one is to pay the ransom, which isn’t an option for many victims; and the other is to apply instruments that take advantage of the ransomware’s possible weaknesses. If the latter is your pick, the advice below is a must-try.

Ransomware Prevention Tips

To avoid JungleSec ransomware and other file-encrypting infections in the future, follow several simple recommendations:

These techniques are certainly not a cure-all, but they will add an extra layer of ransomware protection to your security setup.

Revise your security status

Post-factum assessment of the accuracy component in malware removal scenarios is a great habit that prevents the comeback of harmful code or replication of its unattended fractions. Make sure you are good to go by running an additional safety checkup. Another benefit of using the antimalware tool is that it will keep ransomware threats from intruding on your computer further on.

Download JungleSec removal tool