"Philadelphia" is a type of encrypting ransomware malware created in 2016. It was originally sold and distributed by the Brazilian hacker group, The Rainmaker, but has since circulated on the dark web. Like many forms of ransomware, the malware encrypts computer files and gradually deletes them, demanding a bitcoin ransom to decrypt the files and halt the deletion process.
History Philadelphia was introduced in September 2016, when it was sold as-a-service by The Rainmaker. Promotion began shortly after its release, using spam campaigns via online forums to encourage sales. According to the National Health Service, following the release, the author has sold 38 copies of the malware, each for $389 USD. It was intended to cause harm and generate income through malicious email attachments, compromised websites, macros, Trojanized downloads, and other illegal methods. It activates when users download the software, which encrypts all local user files. A companion website known as "Philadelphia Headquarters" allows attackers to offer a "mercy" option through the program. If chosen, it decrypts their files for free. The malware features many similarities to Stampado, another type of ransomware. Attackers often target the healthcare industry, purposely sending spear-phishing emails to hospitals. Roland Dela Paz, a cybersecurity professional, stated that the ransomware affected a hospital in Southwest Washington and one in Oregon.
Reception Journalist Brian Krebs, on his website, Krebs on Security, described an advertisement for the malware as "fairly chilling." Additionally, noting that the ransomware’s "mercy" feature revolved around pleas from victims who risked losing irreplaceable personal data. Sophos stated that "kits available on the Dark Web allow the least technically savvy among us to do evil." Calling Philadelphia one of the "slickest, most chilling examples."
References
