Python Ransomware Strikes at Exposed Jupyter Notebook Instances

Python is not a programming language typically associated with ransomware. The majority of ransomware toolkits are coded using different languages. However, in late 2021 a new ransomware strain written in Python was discovered. Python-based ransomware is now being used in a new attack campaign, targeting the Jupyter Notebook platform.

Jupyter Notebook is a web-based interactive computing platform, commonly used for visualizations of various types of data.

A research team with Aqua Security discovered the new attack using the Python-based ransomware strain.

Exposed and misconfigured instanced targeted

The way the new campaign finds its victims is relatively simple. The threat actors behind the campaign scan for Jupyter Notebook environments that have been left unsecured, due to poor configuration.

The Aqua Security team set up a testing environment, leaving the instance of Jupyter Notebook exposed and unsecured on purpose. The threat actor got into the researcher-operated instance and downloaded a number of malicious tools on the server using terminal commands. In a surprisingly laborious step, given how most malware campaigns work, the hackers then generated a Python script manually and used that script to execute the ransomware payload.

Even though the hackers likely figured out they were working in a honeypot and not a real target and did not finish the attack, researchers believe they know enough to figure out what the full attack chain looks like.

Python ransomware likely still in testing phase

The payload encrypts files first, then deletes the unencrypted copies, and then the script used to launch the ransomware as well. The absence of a ransom note and any sort of monetary demand as part of the process likely indicates that the ransomware is still being tested and improved.

The nature of Jupyter Notebook environments as targets makes those Python ransomware attacks dangerous. Data handled and processed by the Jupyter Notebook environment that is targeted might be of a sensitive nature and lead to significant damage to the entity working with it.