Ransomware is housed in a trojanized version of the Java Runtime Environment (JRE) The malware is compiled into a Java image file (JIMAGE) that s rarely used by developers. Its victims so far have largely consisted of small- and medium-sized organizations in the education and software industries, researchers said. Tycoon ransomware is triggered by executing a shell script that runs the main malicious Java module, of which there are both Windows and Linux versions. It uses an embedded Windows utility called cipher.exe for encrypting files present on the compromised machine.
Source: https://threatpost.com/tycoon-ransomware-unusual-image-file-tactic/156326/