VENOMOUS Ransomware Encrypts Files and Terminates Database Processes

Cyble Research Labs detailed VENOMOUS ransomware, a Python-based x64 console executable that encrypts victim files with AES-256, appends a VENOMOUS-themed extension, and drops a ransom note named SORRY-FOR-FILES.txt. The malware uses a configuration file to store a victim-specific ID and requires an operator to supply an encryption key at runtime, indicating a likely manual deployment model or affiliate-driven operation rather than fully automated mass distribution. Each encrypted file contains a unique IV, and victims are directed to contact the operators through a Tor site, Telegram, and a Tutanota email address, with payment demanded in Bitcoin.

The ransomware also attempts to improve encryption impact by terminating MSSQL, MySQL, and other SQL-related processes before locking files, a behavior aligned with MITRE ATT&CK T1562.001 for impairing defenses by disabling or modifying tools and services. By stopping database services that could otherwise keep files locked or in use, VENOMOUS increases the likelihood of successful encryption across enterprise environments and raises the operational disruption caused by an intrusion.