Ransomware - Venus

Researchers attribute Venus to Zeoticus and Zeoticus 2.0 because of the ransom notes and the use of the string "goodgamer" as a file marker, and "goodgame" as one of its file extensions. The similarities in the ransom notes are undeniable. They look identical and have the same formatting and extortion communication mediums. What's interesting is that Zeoticus and Zeoticus 2.0 used a combination of XChaCha20 to encrypt files and curve25519xsalsa20poly1305 to ensure the encryption key couldn't be recovered. Venus, on the other hand, uses a combination of AES to encrypt files and RSA to encrypt the AES key. Additionally, when Venus encrypts files, it changes the desktop icon of the encrypted file. Neither Zeoticus variant did that. So, it appears that Zeoticus and Venus are vastly different encryptors but created by the same threat actor. or it could be that the Zeoticus threat actor(s) acquired Venus from someone else.

Venus came after Zeoticus, which led to 2023Lock, and then TrinityLock. The latter two, also returning to the combinatory encryption algorithm of XChaCha20 and curve25519xsalsa20poly1305. This further suggests Venus was a different entity entirely. Further evidence of this is the methods of access to victim networks. Venus has been widely reported in the media for encrypting servers and other machines with RDP exposed to the Internet, no matter the port.

The Venus operators appeared on a hacking forum (RAMP) to elicit help from pen testers at one point, indicating Venus' operators could have run a Ransomware-as-a-Service model. The use of several different file extensions appended onto encrypting files and the large number of emails discovered support this.