Nnice Targets Windows Systems with Advanced Encryption Techniques

A new ransomware strain, known as Nnice, has emerged as a formidable threat to Windows systems, employing sophisticated encryption algorithms and evasion strategies. First identified on January 17, 2025, by CYFIRMA’s Research and Advisory team, Nnice has quickly garnered the attention of the cybersecurity community due to its advanced capabilities and highly efficient attack methods.

Advanced Encryption Methods

Nnice ransomware is designed to encrypt victim’s files with a unique “.xdddd” extension, using a hybrid encryption logic that combines the Salsa20 symmetric encryption algorithm with RSA-2048 asymmetric encryption. This dual-layered approach ensures both speed and security:

1. Salsa20 is employed for bulk data encryption, providing rapid encryption performance.
2. RSA-2048 is used for key management, ensuring robust security against unauthorized decryption attempts.

This hybrid approach mirrors techniques seen in other sophisticated ransomware strains but introduces notable enhancements in speed and complexity. CYFIRMA researchers have reported that Nnice’s encryption process is highly efficient, encrypting files within seconds rather than hours, a capability that sets it apart from many other ransomware families.

Multi-Layered Encryption Strategy

Nnice’s encryption process follows a three-step methodology that significantly complicates decryption efforts:

1. Random RSA Key Encryption: A randomly generated RSA key is encrypted using a built-in RSA key.
2. RC4 Key Encryption: A randomly generated RC4 key is encrypted using the previously generated RSA key.
3. File Encryption: Victim’s files are encrypted using the RC4 key.

This multi-tiered encryption method makes decryption virtually impossible without access to the attacker’s private key, reinforcing Nnice’s effectiveness as a ransomware strain.

Evasion and Persistence Techniques

Nnice exhibits advanced evasion techniques that make it particularly challenging to detect and neutralize:

• Service Termination: It stops services and terminates processes that could interfere with its encryption process.
• Process Injection: Nnice creates child processes that mimic legitimate system services to confuse debugging tools and evade detection.
• System Permissions: The ransomware attempts to gain elevated permissions to access and encrypt critical system files.

Additionally, Nnice utilizes intermittent encryption technology, offering three modes:

1. Full Encryption: Encrypts entire files comprehensively.
2. Partial Encryption: Encrypts specific parts of files.
3. Smart Encryption: Uses intermittent technology to selectively encrypt parts of files, accelerating the process while rendering files unusable.

Attack Methodology

While the exact attack vector of Nnice remains unclear, it is suspected to propagate through:

• Phishing Emails: Luring victims with malicious attachments or links.
• Exploitation of Vulnerable Systems: Targeting systems with outdated software or unpatched vulnerabilities.

Once executed, Nnice changes the victim’s desktop wallpaper and leaves a ransom note titled “Readme.txt” with instructions for file recovery.

MITRE ATT&CK Techniques Identified

CYFIRMA researchers have mapped several MITRE ATT&CK techniques used by Nnice:

• T1486: Data Encrypted for Impact
• T1490: Inhibit System Recovery
• T1055: Process Injection
• T1562: Impair Defenses
• T1070: Indicator Removal

These techniques highlight the ransomware’s capacity to disable recovery options, inject processes for evasion, and remove evidence of its presence.

Mitigation Recommendations

To combat the threat posed by Nnice, cybersecurity experts recommend the following measures:

1. Implement Robust Backup Systems: Regularly back up critical data and store backups offline to ensure recovery in the event of an attack.
2. Update Software and Patch Vulnerabilities: Keep all systems and software up to date to reduce potential entry points for ransomware.
3. Deploy Advanced Threat Detection Tools: Utilize tools that can detect and mitigate ransomware activities before encryption occurs.
4. Employee Awareness: Conduct training to recognize phishing emails and other common attack vectors.

Nnice’s emergence serves as a stark reminder of the ever-evolving ransomware landscape. As attackers refine their techniques, organizations must adopt a proactive and multi-layered approach to cybersecurity to safeguard their systems and data.