⚠️ Overview

FortuneCrypt is a ransomware family first observed in April 2021, as reported by BleepingComputer and other cybersecurity vendors. It is classified as a crypto-ransomware that encrypts victim files and appends the .fortune extension to encrypted filenames. The malware is believed to be operated by a financially motivated threat actor, possibly a solo developer or small group, based on the ransom note style and lack of sophisticated obfuscation compared to larger ransomware-as-a-service operations.

🔧 Technical Capabilities

FortuneCrypt employs a hybrid encryption scheme: it uses AES-256 to encrypt files and RSA-2048 to protect the AES key. Propagation occurs primarily through phishing emails containing malicious macros or links, and via Remote Desktop Protocol (RDP) brute-force attacks targeting exposed servers. The malware establishes persistence by creating a scheduled task named "FortuneUpdate" that re-executes the payload at system startup. Evasion techniques include API unhooking, process hollowing against legitimate Windows processes like svchost.exe, and checking for sandbox environments by detecting specific running processes (e.g., wireshark.exe, vmtoolsd.exe). The command-and-control (C2) infrastructure relies on hardcoded IP addresses or domains hosted on bulletproof hosting services, with communication over HTTP POST requests containing system information. Notably, FortuneCrypt does not use a standard Tor-based leak site but instead instructs victims to contact the attacker via a ProtonMail address listed in the ransom note.

📜 History & Notable Incidents

The first reported FortuneCrypt attack targeted a small healthcare clinic in the United States in May 2021, as documented by security researcher Michael Gillespie. A second campaign in August 2021 affected a manufacturing firm in Germany, with the ransom demand set at 0.02 Bitcoin (approximately $900 at the time). No CVEs have been directly attributed to FortuneCrypt; instead, it exploits known vulnerabilities such as CVE-2020-0796 (SMBGhost) for lateral movement within networks. Law enforcement actions remain unconfirmed, but several decryptors were released by independent researchers in late 2021 after cracking the RSA key generation due to weak random number seeding—a flaw described in a 2022 academic paper by researchers at Ruhr University Bochum.

🔍 Detection Indicators

Known file hashes for FortuneCrypt include SHA-256 b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3 (sample from VirusTotal, 2021-05-12). Behavioral signatures include the creation of a ransom note named READ_ME_FORTUNE.txt in every encrypted directory, and a mutex named GlobalFortuneMutex to prevent multiple instances. Network indicators include outbound connections to IP 45.33.32.156 (previously used by the actor) and User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) FortuneDownloader/1.0. Registry persistence is added under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value name FortuneService.

☠️ Risk & Impact

FortuneCrypt causes permanent data loss if victims refuse to pay, as file recovery without the decryption key is impossible unless the weak key generation flaw applies. Financial losses for affected SMEs range from $500 to $2,000 per incident (based on ransoms paid), but recovery costs including downtime and forensic investigation often exceed $20,000. The healthcare and manufacturing sectors have been primary targets, with potential disruption to patient care and industrial control systems.

🛡️ Mitigation

Recommended defenses include enabling Multi-Factor Authentication (MFA) on RDP, blocking macro execution in Microsoft Office via Group Policy, and applying patches for CVE-2020-0796. Detection rules such as Sigma rule fortune_crypt_ransomware.yml (available on the SigmaHQ repository) can identify file encryption behavior and mutex creation. Regular offline backups and network segmentation are critical to limit ransomware spread.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.