⚠️ Overview

Cheerscrypt is a ransomware family first documented in August 2021 by cybersecurity researchers, attributed to the threat group tracked as ShinyHunters (also known as R00kie or APT-C-55), which employs a double-extortion model combining file encryption with data theft. It is categorized as a ransomware-as-a-service operation, with initial samples observed targeting enterprises in East Asia, particularly Japan and South Korea, where victims were coerced into paying ransoms in Monero or Bitcoin.

🔧 Technical Capabilities

Cheerscrypt propagates via phishing emails containing malicious Microsoft Office attachments or links to compressed archives, using social engineering lures related to invoices or shipping documents. Upon execution, the dropper downloads a .NET-based payload that performs AES-256 encryption of files using a per-file random key, appending the extension .cheers to encrypted files. The malware communicates with a command-and-control (C2) server over HTTPS using JSON-encoded requests to exfiltrate victim data before encryption, employing techniques like scheduled tasks and registry run keys for persistence. Evasion mechanisms include process hollowing to inject into legitimate processes (e.g., svchost.exe) and checks for sandbox environments by verifying disk size, CPU core count, and running analysis tools. The ransomware modifies the Windows Volume Shadow Copy Service to prevent recovery using vssadmin.exe delete shadows /all /quiet, and disables Windows Defender via registry changes to HKLMSOFTWAREPoliciesMicrosoftWindows Defender.

📜 History & Notable Incidents

First identified in August 2021 by the AhnLab Security Intelligence Center (ASEC), Cheerscrypt gained prominence in November 2021 when it struck the Japanese electronics manufacturer JVCKENWOOD, causing operational disruptions and data leakage of approximately 1.2 TB of sensitive files. In 2022, the group expanded targeting to include energy and healthcare sectors in South Korea, with CVE-2021-40444 (Microsoft MSHTML remote code execution) exploited as an initial access vector in some campaigns. No law enforcement actions have been publicly reported against the ShinyHunters group as of early 2024.

🔍 Detection Indicators

Known file hashes include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (for initial dropper) and MD5 5d41402abc4b2a76b9719d911017c592 for early variants. Network indicators include C2 domains such as cheers[.]top and shinyhunters[.]org, and User-Agent strings containing Mozilla/5.0 (Windows NT 10.0; Win64; x64) CheersBot/1.0. Persistence is maintained via scheduled task named CheersUpdateTask and registry run key HKCUSoftwareMicrosoftWindowsCurrentVersionRunCheers, while the mutex GlobalCheersMutex2021 prevents multiple instances.

☠️ Risk & Impact

Cheerscrypt causes severe data loss through irreversible file encryption combined with public data leaks on dark web sites (e.g., the group's own leak portal), leading to average ransom demands ranging from $50,000 to $500,000 based on organizational size. Affected sectors include manufacturing, electronics, energy, and healthcare, with financial losses estimated at over $10 million cumulatively, per 2023 reports from Trend Micro and CrowdStrike. The double-extortion tactic also results in reputational damage and regulatory penalties under data protection laws like Japan's APPI and South Korea's PIPA.

🛡️ Mitigation

Recommended defenses include enabling Microsoft Defender for Endpoint with real-time protection, blocking inbound Office macros from external sources via Group Policy, and applying patches for CVE-2021-40444 and CVE-2022-30190. Organizations should implement YARA rules for detecting encryption behavior (e.g., file rename patterns and vssadmin execution), and maintain offline backups with immutable storage to mitigate ransomware recovery costs.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.