The complete source code for the Paradise Ransomware was released on a hacking forum that can be used by any aspiring cyber criminal to develop their own customized ransomware operation.
The link to the source code that was released on the hacking forum XSS, is only accessible to active users on the site who have previously replied to or reacted to other posts on the site.
Security Joes researcher Tom Malka, compiled the source code package and found it creates three executables – a ransomware configuration builder, the encryptor, and a decryptor.
Russian comments can be seen here and there on the source code which indicates the native language of the developer.
A Paradise ransomware affiliate can use the builder to customize their own version of the ransomware to include a custom command and control server, encrypted file extension, and contact email address.
After creating a customized ransomware, the affiliates can distribute the malware in their campaigns to target victims.
The Paradise Ransomware operation was first launched in September 2017 through phishing emails containing malicious IQY attachments that downloaded and installed the ransomware.
Since then, multiple versions of the ransomware were released, with initial versions containing flaws that led to the release of a Paradise Ransomware decryptor.
In the new versions, the encryption method was changed to RSA, which prevented the free decryption of files.
Of the several versions of Paradise that were released it is not clear if they were all developed by the same group as they were all circulating at around the same time with thousands of different extensions.
The Paradise Ransomware was found to be heavily distributed between September 2017 and January 2020, when it suddenly reduced now, where it is rarely seen.
The released source code is for the secure version of Paradise Ransomware that utilizes RSA encryption to encrypt files.
By using this source code, the aspiring threat actors can easily modify it to release their own customized version of the ransomware, allowing an easy entry point into creating a new ransomware operation.