- A researcher from RAPID7 created a work certificate for concept for a CPU -Ransomware
- Such ransomware would continue on a device even after the hard drive had been replaced
- Poc will (probably) never see the light of day
A security researcher wrote Ransomware code that infects the computer’s CPU, making it invisible to practically any antivirus program out there, and makes it persistent even when the victim takes out and replaces the computer’s hard drive.
This is according to the register that recently spoke with Christiaan Beek, a Rapid CyberSecurity researcher who claims to have created a proof-of-concept (POC) for such ransomware.
CPU Malware is not exactly Arkane Science. We’ve seen it in the past, just like Jolax, Cosmicstrand and other UEFI firmware -rodkits. However, this is the first time anyone has played with ransomware this way.
CPU POC
Beek said he was inspired by an error in AMD Zen processors that allowed threat actors to load malicious microcode and break the hardware level encryption. This would have enabled them to change the behavior of CPUs as they so appropriate.
Beek says the leaked Conti Chatlogs files from 2022 suggested that actual cyber criminals discussed the same idea before, but they have not yet come to a functioning solution. At least not that the cybersecurity community knows about.
“If they worked on it a few years ago, you can bet that some of them will be smart enough at some point and start creating these things,” the researcher told the publication.
He also said he doesn’t release the code on the Internet: “Of course we won’t release it, but it’s fascinating, right?”
Ransomware is still one of the biggest threats out there where companies of all sizes lose billions of dollars each year. In fact, a recent VEEAM study, which gained insights from 1,300 CISOs, IT leaders and security professionals throughout America, Europe and Australia, found that almost three-quarters of companies were affected by ransomware in the past year.
Via Registered
