A new ransomware called 'Night Sky' is targeting corporate networks and stealing data in double-extortion attacks.
The Night Sky operation has published the data of two victims. One of the victims has received an initial ransom demand of $800,000 to obtain a decryptor and for stolen data not to be published.
When encrypting files, Night Sky will append the .nightsky extension to encrypted file names. In each folder a ransom note named NightSkyReadMe.hta contains information related to what was stolen, contact emails, and hard coded credentials to the victim's negotiation page.
When launched, the ransomware will encrypt all files except those ending with the .dll or .exe file extensions. Instead of using a Tor site to communicate with victims, Night Sky uses email addresses and a clear web website running Rocket.Chat.
Night Sky has created a Tor data leak site that currently includes two victims, one from Bangladesh and another from Japan, to leak victim's data.
