{"id":3022,"date":"2024-09-25T20:58:07","date_gmt":"2024-09-25T20:58:07","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=3022"},"modified":"2025-07-29T06:57:28","modified_gmt":"2025-07-29T06:57:28","slug":"hiddentear-proliferates-is-this-part-of-a-open-source-trend-that-will-make-the-whole-world-cry","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/hiddentear-proliferates-is-this-part-of-a-open-source-trend-that-will-make-the-whole-world-cry\/","title":{"rendered":"HiddenTear Proliferates. Is this part of a Open-Source trend that will make the whole world cry?"},"content":{"rendered":"
\n
\"\"<\/figure>\n<\/div>\n\n\n

Recently LMNTRIX threat intelligence has observed a sudden spike in open-source ransomware across the Dark Web, and HiddenTear is topping the list.  The initial propagation of HiddenTear was from a Github project started by UtkuSen<\/a>, with a disclaimer that the code was published for educational purposes.

 <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n



Korean threat actors are believed to have taken over the HiddenTear project and have developed multiple variants of the ransomware in different programming languages. These variants now appear to be being traded openly on the Dark Web, raising the spectre of impending harm to a range of industries as the volume of harder-to-detect ransomware increases. 

Our team has observed multiple such variants in the Dark Web. Below is a list of of HiddenTear ransomware variants that are available as of today:

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

The Dark Web appears to be fascinated with open-source ransomware, with selling boards everywhere calling it an \u201c[OpenSource] Ransomware Recopilation\u201d<\/strong>

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n



There are various types of open-source ransomware being sold in the dark markets, complete with download links and passwords. Some of the variants include the following:

 Andr0id L0cker – Panel + Source Java 

BasicLocker – Source   C# 

CryptoLocker – Source   C# 

CryptoWire – Source   AutoIT 

GO Ransomware – SourCe   GO 

HiddenTear – Source   C# 

M.D.Groot Ransomware – Source  C# 

MyLittleRansomware – Source  C# 

NxRansomware – Source + Panel  C# 

Shell Screen Locker – Source  VB 

YourRansom – Source   GO<\/em><\/strong>

Here are a few screenshots showing some of them:

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

In order to validate the authenticity of some of these download links we tried to download the \u201cGo Ransomware\u201d sample – and –Bingo!– the download link proved active.

Code Analysis:<\/strong>

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

The \u201cMain.go\u201d module consists of an \u201cIf \u201c function (as shown in the highlighted section above) , and all files matching the condition are encrypted with the extension \u201c.youransom\u201d. 

In the Filter function (below) we can see the suffix list, which are the file types for which the Ransomware performs the encryption. 

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n



The combination of open-source and the darknet is a significant one because it encourages the ready morphing of a possible limitless number of variants that will thwart detection.  We will continue to monitor this trend.<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Recently LMNTRIX threat intelligence has observed a sudden spike in open-source ransomware across the Dark Web, and HiddenTear is topping the list.  The initial propagation of HiddenTear was from a Github project started by UtkuSen, with a disclaimer that the code was published for educational purposes.   Korean threat actors are believed to have taken […]<\/p>\n","protected":false},"author":1,"featured_media":3031,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-3022","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/3022","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=3022"}],"version-history":[{"count":5,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/3022\/revisions"}],"predecessor-version":[{"id":4353,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/3022\/revisions\/4353"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/3031"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=3022"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=3022"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=3022"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}