A newly-discovered strain of ransomware is using Java to target Windows and Linux PCs belonging to software and education-focused organisations.
The malware, named Tycoon, was uncovered and analysed by BlackBerry’s Research and Intelligence and KPMG’s UK Cyber Response Services teams. Their researchers believe that the malware has been active since December 2019, yet was able to “fly under the radar” due to using “an obscure Java image format”.
Tycoon is known to be deployed as a trojanised Java Runtime Environment, being compiled in a Java image file (Jimage) in order to conceal its malicious intent. The malware is spread by connecting to a system using a remote desktop protocol (RDP) server.
KPMG’s and BlackBerry’s researchers explained that “the threat actors behind Tycoon were observed using highly targeted delivery mechanisms to infiltrate small to medium-sized companies and institutions in education and software industries, where they would proceed to encrypt file servers and demand a ransom,” which is paid in bitcoins.
However, the researchers claim that because of the reuse of a fairly common RSA private key, it may be possible to recover encrypted data without having to pay.
Tycoon uses encrypted files extension such as “thanos”, “grinch”, and “redrum”, and its encrypted files signatures include “happyny3.1” and “redrum3_0”.
Although KPMG and BlackBerry’s teams are familiar with “a substantial increase in ransomware written in languages such as Java and Go”, they said that Tycoon “is the first sample we've encountered that specifically abuses the Java JIMAGE format to create a custom malicious JRE build”.
RELATED RESOURCE
How enterprises are embracing cyber security challenges
Enterprises across Europe, the Middle East and Africa are undergoing a significant transformation
“Malware writers are constantly seeking new ways of flying under the radar,” they explained. “They are slowly moving away from conventional obfuscation and shifting towards uncommon programming languages and obscure data formats.”
It has not been revealed how many organisations had fallen victim to the Tycoon malware. The number is believed to be limited as hackers appear to be choosing their targets carefully.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
-
The Zservers takedown is another big win for law enforcementNews LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
-
There’s a new ransomware player on the scene: the ‘BlackLock’ group has become one of the most prolific operators in the cyber crime industry – and researchers warn it’s only going to get worse for potential victimsNews Security experts have warned the BlackLock group could become the most active ransomware operator in 2025
