Rorschach

Rorschach, also known as BabLock, is a malware variant that has been recognized for its speed and sophistication. It is a form of ransomware that encrypts files on infected systems at an unprecedented rate, with Check Point researchers noting it as one of the fastest ransomware variants ever observed based on its speed of encryption. The malware leverages hybrid cryptography, encrypting only parts of a file rather than the entire file, which allows it to achieve these fast speeds. In tests conducted by Check Point, Rorschach was able to encrypt 22,000 files in an average of four minutes and 30 seconds. This stealthy and expeditious ransomware first emerged in April 2023 and has since caused significant disruptions. Notably, it disrupted operations of major Chilean telecommunications provider Grupo GTD on October 23, 2023. This attack affected the company's data centers, Voice-over-IP, and internet access, impacting not only Chile but also other Latin American countries that the provider caters to. The cyberattack against GTD's infrastructure-as-a-service platform was confirmed by Chile's Computer Security Incident Response Team to be a Rorschach ransomware attack. Rorschach shares many characteristics with other ransomwares such as LockBit and Babuk, and has inspired several other ransomware strains including Nokoyawa and EXSiArgs. Its code has resurfaced in various other ransomware samples, indicating its widespread influence in the realm of malicious software. Furthermore, Rorschach operates under CryptNet, a Ransomware as a Service (RaaS) group, which claims to have the “fastest ransomware in the world,” a claim previously limited to Lockbit and Rorschach. This malware continues to pose a significant threat due to its speed, stealth, and ability to propagate autonomously.