Unpacking the AI-Driven Ransomware on VS Code Marketplace

A surprising new extension, reportedly crafted with AI involvement, has emerged on the Microsoft VS Code marketplace. Dubbed “susvsex,” this curious tool is attributed to a publisher called ‘suspublisher18’ and brazenly describes its menacing capabilities right in the description. It’s not every day you see ransomware features marketed so openly.

John Tuckner, a diligent researcher at Secure Annex, stumbled upon this suspicious extension. Intriguingly, it’s tied to what he calls “vibe coding,” suggesting a distinctive lack of polish. Though its potential for harm is clear—with promises of file theft and potent AES-256-CBC encryption methods—Microsoft hasn’t yet responded to Tuckner’s alert for its removal. This highlights a gap in the marketplace’s regulation that needs urgent attention.

Diving into Ransomware Features

Once the extension, or the VS Code platform, is running, it springs into action. The culprit is the ‘extension.js’ file, a script loaded with sensitive data like IP addresses and encryption keys crucial for its malicious operations. Tuckner further reveals some of the code’s inner workings seem suspiciously AI-generated, hinting at the tools being employed behind the scenes.

• The extension hunts for a specific marker file.
• It encrypts files and packages them into a .ZIP format.
• Files are sent to a remote server before being replaced with encrypted copies.

Moreover, it communicates with a private GitHub repository, fishing for further instructions using a personal access token. Through this token, Tuckner connected dots back to Azerbaijan, where the repository’s owner likely resides.

The extension could be a probing attempt into Microsoft’s security measures. Though labeled by Secure Annex as “AI slop,” the potential for transformation into a more sophisticated threat remains. While still available at the time of writing, its status may have changed following these insights. BleepingComputer has reached out to Microsoft for their perspective. Stay tuned for updates.

Stay safe and informed with Qsentinel – your watchful eye in cybersecurity!

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.