Paradise Ransomware source code released on a hacking forum

The complete source code for the Paradise Ransomware has been released on a hacking forum allowing any would-be cyber criminal to develop their own customized ransomware operation.

Released on the hacking forum XSS, the link to the source code is only accessible to active users on the site who have previously replied to or reacted to other posts on the site.

Security Joes researcher Tom Malka, who shared the source code with BleepingComputer, compiled the package and found it creates three executables - a ransomware configuration builder, the encryptor, and a decryptor.

Sprinkled throughout the source code are Russian comments, clearly demonstrating the native language of the developer.

A Paradise ransomware affiliate can use the builder to customize their own version of the ransomware to include a custom command and control server, encrypted file extension, and contact email address.

Once the customized ransomware is created, affiliates can distribute the malware in their campaigns to target victims.

Welcome to Paradise

The Paradise Ransomware operation first launched in September 2017 through phishing emails containing malicious IQY attachments that downloaded and installed the ransomware.

Over time, multiple versions of the ransomware were released, with initial versions containing flaws that led to the release of a Paradise Ransomware decryptor.

However, the new versions switched the encryption method to RSA, which prevented the free decryption of files.

Michael Gillespie, who created the original Paradise Ransomware decryptor, told BleepingComputer that the versions of Paradise that were released include:

Paradise - Native version that had the flaws allowing decryption. Paradise .NET - A secure .NET version that switched encryption algorithms to use RSA encryption. Paradise B29 - A "Team" variant that only encrypted the end of a file.

Gillespie said that it is not clear if they were all developed by the same group as they were all circulating at around the same time with thousands of different extensions, as threat actors flocked to the growing Ransomware-as-a-Service.

Based on submissions statistics to ID Ransomware, the Paradise Ransomware was heavily distributed between September 2017 and January 2020, when it suddenly tapered off until now, where it is rarely seen.​

Unfortunately, Gillespie tells BleepingComputer that the source code is for the secure version of Paradise Ransomware that utilizes RSA encryption to encrypt files.

Using this source code, other threat actors  can easily modify it to release their own customized version of the ransomware, allowing an easy entry point into creating a new ransomware operation.