CloudSEK’s Threat Intelligence Research team analyzed the profile of the Night Sky ransomware group.

Executive Summary

• CloudSEK’s Threat Intelligence Research team analyzed the profile of the Night Sky ransomware group.
• This group doesn’t have a significant online presence, apart from their exclusive Onion website, where they post their activities and updates.
• So far the group has targeted two Asian companies across industries.
• CloudSEK’s Threat Intelligence team conducted further research to analyze the group’s operations and Tactics, Techniques, and Procedures (TTPs).  

Night Sky Ransomware Group : Detailed Analysis

• Night Sky is a newly emerged ransomware group that maintains a presence on the dark web. They only have two victims currently, and these companies are based out of Asia. 

• The two victims of the Night Sky ransomware group are:

1. Tokyo Computer Service (Date posted: 30 December 2021)

2. AKIJ Group Ltd (Date posted: 28 December 2021)

• To substantiate their claims, the ransomware group has also provided samples for each of their victims. The database is currently available only for victims and any interested third-party buyers.
• The group claims to be giving away all of the information for free. 

Information from Open-Sources

• The Night Sky ransomware encrypts the following files:

• The group leaves a ransom note titled ‘NightSkyReadMe.hta’.
• The communication channel provided by the group is: [victim_name]@nightsky.cyou.
• The ransomware group appends the .nightsky extension while encrypting sensitive files.  
• The VirusTotal records from the domain nightsky.cyou are:

• On their Twitter account, DarkFeed.io revealed the list of active users on Night Sky’s support chatbot, where victims negotiate with the ransomware operators. .