Ransomware Roundup: Cryptonite Ransomware

After Cryptonite has been executed, It actively checks for internet connections and stops execution if non are detected. If an Internet connection is active and established, it encrypts the targeted system. Later, encrypted file extensions are changed to “.cryptn8” by default. After identifying the IP address using “ipinfo.io”, It connects to “ngrok.io” to pass the victim’s details back to the attacker. Finally, a ransomware window is shown on the victim’s machine with a box where the victim can enter the key and instructions on how to obtain it.