Rorschach Ransomware

The Rorschach ransomware, also known as BabLock, is a new and unique strain of malware that was first identified by Check Point Research (CPR) and the Check Point Incident Response Team (CPIRT) in April 2023. The ransomware, which was named after the famous psychological test due to its varied appearance to different examiners, has been used in attacks against US-based companies. Notably, it supports the fastest file-encrypting routine observed to date, making it particularly damaging. The malware operates through an encrypted file, config.ini, which contains all the logic and configuration for the ransomware. Rorschach ransomware's deployment process is distinctive, bearing some similarity to features implemented by LockBit 2.0, but carried out differently. This, along with the lack of branding, makes it difficult to attribute the ransomware to any known operators or developers, who remain unidentified. When infecting a machine, Harmony Endpoint Anti-ransomware detected the encryption process in various folders, including alterations made to Harmony Endpoint 'honeypot' files. This strain of ransomware has drawn attention for its targeted approach. Similar to the ALPHV/BlackCat, ESXiArgs, LockBit, Play, Rook, Black Basta, Defray, MichaelKors, and other ransomware gangs, Rorschach ransomware has shown a preference for VMware ESXi and Linux systems. Most notably, it was involved in an attack on GTD, as reported by BleepingComputer. Despite the increasing prevalence of this ransomware variant, the identities of the operators and developers behind these attacks remain unknown.