Brad Hawkins, Author at Safernet

SolarMarker Malware Targets Healthcare and Education Sectors

Post On: 27 August, 2021 By : Brad Hawkins

A new surge of attacks against the Healthcare and education sectors has been attributed to SolarMarker Malware, a .NET-based information stealer and keylogger. The attacks have gone under the radar, for the most part, owing to the threat actors skills in obfuscation. SolarMarker Malware is believed to have been active since September 2020, with telemetry data pointing to malicious actions as early as April 2020, according to Cisco Talos.

“At its core, the Solarmarker Malware campaign appears to be conducted by a fairly sophisticated actor largely focused on credential and residual information theft,” Talos researchers Andrew Windsor and Chris Neal said in a technical write-up published last week.

According to the report, a Solarmarker Malware infection consists of multiple moving parts, primarily a .NET assembly module that serves as a system profiler and staging ground on the victim host for command-and-control (C2) communications and further malicious actions, including the deployment of information-stealing components like Jupyter and Uran.

The assembly module is capable of stealing personal data, credentials, and form submission values from a targets Firefox or Chrome browsers. The latter acts as a keylogger to capture the victim’s keystrokes.

The renewed use of SolarMarker Malware has been accompanied by a shift in tactics and multiple iterations to the infection chain. Still, the hackers behind the virus still latch to the tactic of SEO poisoning, which refers to the abuse of search engine optimization (SEO) to gain more eyeballs and traction to malicious sites or make their dropper files highly visible in search engine results.

“Operators of the malware known as SolarMarker Malware, Jupyter, [and] other names are aiming to find new success using an old technique: SEO poisoning,” the Microsoft Security Intelligence team disclosed in June. “They use thousands of PDF documents stuffed w/ SEO keywords and links that start a chain of redirections eventually leading to the malware.

Talos’ static and dynamic analysis of Solarmarker Malware’s artifacts points to a Russian-speaking adversary, although the threat intelligence group suspects the malware creators could have intentionally designed them in such a manner in an attempt to mislead attribution.

“The actor behind the Solarmarker Malware campaign possesses moderate to advanced capabilities,” the researchers concluded. “Maintaining the amount of interconnected and rotating infrastructure and generating a seemingly limitless amount of differently named initial dropper files requires substantial effort.”

“The actor also exhibits determination in ensuring the continuation of their campaign, such as updating the encryption methods for the C2 communication in the Mars DLL after researchers had publicly picked apart previous components of the malware, in addition to the more typical strategy of cycling out the C2 infrastructure hosts.”.

SolarMarker Malware Analysis

Note: This analysis was carried out by CrowdStrike.

Based on observed filenames in public malware repositories (e.g., Advanced-Mathematical-Concepts-Precalculus-With-Applications-Solutions.exe) and Falcon telemetry, the hypothesis is that the malware is delivered as a fake document download targeting users performing web searches for document files. CrowdStrike has observed a number of Google Sites hosted pages as lure sites for malicious downloads. These sites advertise document downloads and are often highly ranked in search results. The use of Google Sites suggests attempts by the threat actors to increase search ranking.

The malware installer filenames and lure sites have only been observed in English so far, and based on Falcon telemetry, it is clear that SolarMarker Malware is most prevalent in Western countries, especially in the U.S.

The executable with SHA256 hash

3e99b59df79d1ab9ff7386e209d9135192661042bcdf44dde85ff4687ff57d01

is an Inno Setup Installer. This program is the first stage in a multi-stage dropper chain leading to the SolarMarker backdoor. Figure 10 gives an overview of the malware’s dropper chain

The installer uses Inno Setup’s Pascal Scripting feature to customize its actions. It will first extract two temporary files to %Tmp%\.tmp\, where is a unique directory name.

Both files will be deleted once the installer completes. The file Docx2Rtf.exe is the document converter Docx2Rtf version 4.4, a benign file. The file waste.dat is 112 MB in size, but contains only zero bytes, indicating that the file was only included in the installer to increase its size, which is known to prevent detection by some security products. Once these two files are extracted, Docx2Rtf.exeis executed and the installer sleeps for five seconds.

The installer then checks if it is executed on one of its targeted operating system (OS) versions and exits if not. The targeted versions are Windows 8.1, Windows Server 2012 R2, Windows 10 and Windows Server 2016. After being certain about the OS, the installer decrypts a third stage and writes it to %Temp%\.txt, where is a random 32-character hexadecimal string.

The third stage is encrypted twice with different keys, and the installer will only decrypt it once. The decryption function named DECRYPTPS takes in a hex-encoded-encrypted blob and a string-based key and performs a simple XOR operation.

Protection

SaferNet is the perfect solution to the cybersecurity issues that individuals, families, and businesses face today. It not only connects every device using a secure, 24/7 always on, military grade VPN, but it also stops outside cyberthreats, malware and viruses as well. On SaferNet, all users are protected anywhere in the world, all the time, on any cellular or Wi-Fi network. In addition to SaferNet’s VPN and cyber protection, it also offers a range of employee or parental/family internet controls including internet filtering, monitoring, scheduling, and blocking access to websites or even entire website categories

Typically, a business or family would need 3 separate services for a VPN, Malware Protection, and Internet Controls; SaferNet offers all 3 features in one service. SaferNet truly is an endpoint security presence that can be implemented in minutes around the world, on phones, laptops, tablets, and computers at an economical price point that caters to all sizes of businesses and families. SaferNet guarantees a smooth setup and installation process that takes only minutes, and an easily accessible control hub for you to monitor all your employee’s or family members devices; including activity, time spent online, and threats blocked.

FlyTrap Malware Compromises Over 10000 Facebook Accounts

Post On: 27 August, 2021 By : Brad Hawkins

FlyTrap Malware is the name given to a new threat facing Android users with Facebook accounts in more than 140 countries. FlyTrap Malware works by stealing sessions cookies and simple social engineering tricks to get its victim’s credentials. This is carried over malicious apps, where users are asked for their Facebook credentials to log in. Researchers at mobile security company Zimperium detected the new malware and noted that the stolen information was accessible to anyone who discovered FlyTrap’s command and control (C2) server.

FlyTrap Malware campaigns have been active since at least march. The hackers behind the malicious application used high-quality design and managed to distribute the apps through the Google Play store, as well as third-party Android stores.

The lure within the apps consists of offers for free coupon codes (for Netflix, Google AdWords) and voting for the favorite soccer team or player, in tune with the delayed UEFA Euro 2020 competition.

In order to get the reward, the user must log in to the app using Facebook credentials, and the authentication occurs on the legitimate social media domain.

Some of the malicious apps FlyTrap Malware relies on

Due to the apps using the real Facebook single sign-on (SSO) service, they can’t collect users’ credentials. However, FlyTrap Malware uses a JavaScript injection to gather other sensitive information.

“Using this technique, the application opens the legit URL inside a WebView configured with the ability to inject JavaScript code and extracts all the necessary information such as cookies, user account details, location, and IP address by injecting malicious JS code”

The information is fed into the hackers C2 server. Over 10,000 Android users in more than 140 countries have fallen for the ploy.

Countries affected by FlyTrap Malware. Source: Zimperium

Researchers found the numbers by looking through FlyTrap Malware’s C2 server. The server is not secured, and the stolen Facebook session cookies are open to anyone on the Internet who knows where to look.

Zimperium’s Aazim Yaswant says in a blog post today that FlyTrap Malware’s C2 server had multiple security vulnerabilities that facilitated access to the stored information.

The researcher notes that accounts on social media platforms are a common target for threat actors, who can use them for fraudulent purposes like artificially boosting the popularity of pages, sites, products, misinformation, or a political message.

He highlights the fact that phishing pages that steal credentials are not the only way to log into the account of an online service. Logging onto the legitimate domain can also come with risks.

“Just like any user manipulation, the high-quality graphics and official-looking login screens are common tactics to have users take action that could reveal sensitive information. In this case, while the user is logging into their official account, the FlyTrap Malware is hijacking the session information for malicious intent” said Aazim Yaswant, Android malware researcher, Zimperium.

FlyTrap Malware Analysis

Note: This analysis is from the Zimperium Report.

Contrary to popular belief that a phishing page is always at the forefront for compromising or hijacking an account, there are ways to hijack sessions even by logging into the original and legit domain. This Trojan exploits one such technique known as JavaScript injection.

Using this technique, the application opens the legit URL inside a WebView configured with the ability to inject JavaScript code and extracts all the necessary information such as cookies, user account details, location, and IP address by injecting malicious JS code.

The manipulation of web resources is addressed as cross-principal manipulation (XPM) in the research “An Empirical Study Of Web Resource Manipulation In Real-world Mobile Applications.” Successful login into Facebook by the victim initiates the data exfiltration process and can be seen in the below screenshots of the communication with the C&C server.

Several of the Trojans have the same malicious script and therefore identifies the source of data by the parameter “from_app” as seen in the screenshots below.

The Command & Control server makes use of login credentials for authorizing access to the harvested data. Security vulnerabilities in the C&C server expose the entire database of stolen session cookies to anyone on the internet, further increasing the threat to the victim’s social credibility.

Malicious threat actors are leveraging common user misconceptions that logging into the right domain is always secure irrespective of the application used to log in. The targeted domains are popular social media platforms and this campaign has been exceptionally effective in harvesting social media session data of users from 144 countries. These accounts can be used as a botnet for different purposes: from boosting the popularity of pages/sites/products to spreading misinformation or political propaganda.

Just like any user manipulation, the high-quality graphics and official-looking login screens are common tactics to have users take action that could reveal sensitive information. In this case, while the user is logging into their official account, the FlyTrap Malware is hijacking the session information for malicious intent.

FlyTrap Malware is just one example of the ongoing, active threats against mobile devices aimed at stealing credentials. Mobile endpoints are often treasure troves of unprotected login information to social media accounts, banking applications, enterprise tools, and more. The tools and techniques used by FlyTrap are not novel but are effective due to the lack of advanced mobile endpoint security on these devices. It would not take much for a malicious party to take FlyTrap or any other Trojan and modify it to target even more critical information.

Protection

Crytek Hit With Egregor Ransomware And Suffers Data Theft

Post On: 27 August, 2021 By : Brad Hawkins

Game developer Crytek has confirmed that Egregor Ransomware hit their network a few months ago, and has now sent information to customers whose personal information was stolen. The company acknowledged the attack in breach notification letters sent to impacted uses last week. The details from the letter have been leaked by several victims online.

“We want to inform you that Crytek was the victim of a ransomware attack by some unknown cyber-criminals,” Crytek said in a letter mailed to one of their customers impacted in the incident.

“During that attack, certain data had been encrypted and stolen from our network. We took immediate action to prevent the encryption of our systems, further secure our environment, and initiate an internal and external investigation into the incident. Based on our investigation, the information in some cases included individuals’ first and last name, job title, company name, email, business address, phone number, and country”

Crytek tried reassured customers affected by the Egregor Ransomware breach, stating “the website itself was difficult to identify so that in our estimation, only very few people will have taken note of it.”

Crytek added downloading the leaked data would’ve also taken too long, which would have also likely represented a significant hurdle that stopped people from trying to grab it.

Most in the cybersecurity community consider this as the company downplaying the impact of the Egregor Ransomware attack, and such reassurances would only rest easily with individuals with little to no experience in using computers.

Crytek also believes that those who attempted downloading the stolen data were discouraged by the “huge risk” of compromising their systems with malware embedded in the leaked documents.

“While we are not aware of misuse of any information potentially impacted, we are providing this notice as part of our precautions,” Crytek added.

While it is unknown how many Crytek systems were encrypted, it is known the Egregor Ransomware attack had some degree of personalization by the hackers, as the encrypted was renamed to include the ‘.CRYTEK’ extension.

Egregor Ransomware Analysis

Note: This analysis was carried out by Minerva Labs.

The obfuscation Egregor Ransomware uses is similar to the one used in Maze ransomware. Researchers were able to modify Blueliv’s Maze deobfuscation script to fit Egregors obfuscation patterns, which allowed for easier analysis of the ransomware.

TheEgregor Ransomware loader checks for the command line “–nop” and exits if it exists.

As for further unpacking, a large blob of data is decrypted with the following steps:

The blob is xor decoded with a hardcoded key (0x4 in our sample).
The xor’ed data is then Base64 decoded using the windows API function CryptStringToBinaryA.
A hardcoded key and IV is initialized for the ChaCha20 algorithm, which is then used for the final decryption of the payload. The malware authors decided to change the number of rounds of key rotations from the default of 20 to only 4.
After decrypting the second payload, a DLL file, it is copied to a new allocation that is created using VirtualAlloc with the page permissions RWX.

The last stage of the initial loader is the preparation of the payload in memory.Egregor Ransomware reflectively loads the decrypted payload and uses the function CreateThread to transfer execution to its next stage.

The next stage parses the command line, looking specifically for the parameter -p, which contains a password that is used for the decryption of the ransomware binary. The ransomware is decrypted using a stream cipher that shares some of its constants with Rabbit cipher:

Egregor Ransomware is compiled as a DLL file with only one export named “DllEntryPoint”. The function creates a thread that executes the main subroutine of the ransomware.

Before starting the ransomware’s malicious procedure, a function is called to determine the locale of the workstation. The ransomware uses three different Windows API functions to make sure it is not encrypting a computer located in Russia or any other CIS country:

After the locale check, the ransom configuration will be decrypted from a buffer located in the data section of the executable. The first 8 bytes of the encrypted configuration starts with a PNG header which is skipped by the parser before its decryption. The subsequent DWORD contains the size of the configuration to decrypt. Starting from offset 12, the configuration will be decrypted using round-modified ChaCha20 and a hardcoded key and IV.

The ransomware uses the API functions GetLogicalDriveStrings and GetDiskFreeSpace to identify the names and types of the logical disks connected to the device in addition to the amount of free space available in them.

For each execution, a pair of private and public keys are generated. The public key is used for encrypting the symmetrical keys that would later be used for encrypting each file. A unique symmetrical key is generated for every file to be encrypted.

Egregor’s key generation scheme is as follows:

A 2048-bit RSA key pair is generated using CryptGenKey – this is the session key.
The key is then exported using the API CryptExportKey.
The exported private key is encrypted with ChaCha using a randomly generated key and IV.
The ChaCha keys are encrypted using the function CryptEncrypt and the configuration-embedded RSA public key.
The encrypted ChaCha key and the encrypted session key are saved to disk in a hardcoded path, which in our case is %ProgramData%\dtb.dat.
It is worth noting that the ransomware encrypts the session key with the same protocol that is used to decrypt the ransomware payload (Rabbit Cipher).

The ransomware will stop certain processes and services before encrypting the machine. A list of hardcoded process names is stored in the encrypted configuration file and the malware uses NtQuerySystemInformation to enumerate the running processes and terminates them using the function NtTerminateProcess.

Egregor has the capability to contact hardcoded HTTP URLs. If the offset 0x3a31e and 0x32fb in the configuration does not contain 0, the ransomware will contact IP address/DNS names (which are also embedded in the configuration), and decode their content using the same modified-ChaCha20/Base64 combination used before.

Protection

Australian Government Warn Of Increase in LockBit Ransomware Attacks

Post On: 27 August, 2021 By : Brad Hawkins

LockBit Ransomware is posing a serious threat to Australian and global organizations as of July 2021, according to a new report by the Australian Cyber Security Centre (ACSC). “ACSC has observed an increase in reporting of LockBit ransomware incidents in Australia,” The ACSC said in a report published earlier this month.

According to the ACSC, LockBit Ransomware victims are also reporting threats of having their data stolen during the attacks leaked online. This tactic, known as Double Extortion, is a popular tactic amongst ransomware gangs to force their targets into meeting payment demands.

“The majority of victims known to the ACSC have been reported after July 2021, indicating a sharp and significant increase in domestic victims in comparison to other tracked ransomware variants,” the ACSC added.

“The ACSC has observed LockBit affiliates successfully deploying ransomware on corporate systems in a variety of sectors including professional services, construction, manufacturing, retail, and food.”

The ACSC included a ransomware profile with additional information on the LockBit Ransomware gang, including initial access indicators, targeted sectors, and mitigation measures.

The group pointed out that the LockBit Ransomware gang is opportunistic and could target organizations from any industry sector. This means that just because a sector is not being actively warned of attacks, it doesn’t mean the gang won’t strike.

Since January 2020, the LockBit operators have appeared on Russian-language cybercrime forums. In June 2021, version two of the LockBit RaaS was advertised as ‘LockBit 2.0’ and was allegedly bundled with a built-in information stealing function known as ‘StealBit’.

The ACSC has observed LockBit threat actors actively exploiting existing vulnerabilities in the Fortinet FortiOS and FortiProxy products identified as CVE-2018-13379 in order to gain initial access to specific victim networks.

The LockBit RaaS operators have previously advertised partnership opportunities for threat actors that could provide credential-based accesses to Remote Desktop Protocol (RDP) and Virtual Private Network (VPN) remote access solutions. Additional advertisements sought to recruit threat actors proficient in the use of threat emulation software Cobalt Strike and Metasploit. Threat emulation software is often used in penetration testing environments and by threat actors seeking to gain unauthorized access to or move laterally within target networks.

LockBit Ransomware Analysis

NOTE: This analysis of Lockbit Ransomware was carried out by McAfee

The file found in the investigation of Lockbit Ransomware was a dropper renamed as a .png file. When first opening the .png files we were expecting a real image file, with perhaps some steganography inside, but what we saw instead was the header of a portable executable, so no steganography pictures this time. The PE was compiled in Microsoft Visual C# v7.0 / Basic .NET, .NET executable -> Microsoft.

This encrypted string is decrypted using the key ENCRYPTION29942. The first 32 bytes of the long ExeBuffer string are used as the salt in the encryption scheme, where ENCRYPTION29942 is the passphrase.

The script checks for the existence of vbc.exe on its designated host. Usually, this binary is a digitally signed executable from Microsoft; however, in this case, the malware uses it for process hollowing.

By statically analyzing the file we can spot the usage of:

NtUnmapViewOfSection
LockBit Ransomware uses this API in order to unmap the original code in execution
NtWriteVirtualMemory
The malware writes the base address of the injected image into the PEB via NtWriteVirtualMemory
VirtualAllocEx
To allocate the space before injecting the malicious code
The VBC utility is the visual basic compiler for Windows and LockBit Ransomware uses it to compile and execute the code on the fly directly in execution. If the vbc utility does not exist on the system, the malware downloads the original vbc.exe file from the same malicious URL as seen before. After executing vbc.exe, the malware replaces the objects in memory with the code for deploying the ransomware (as deduced from the exeBuffer).

The list of services LockBit Ransomware tries to stop are:

DefWatch (Symantec Antivirus)
ccEvtMgr (Norton AntiVirus Event Manager)
ccSetMgr (Common Client Settings Manager Service of Symantec)
SavRoam (Symantec Antivirus)
sqlserv
sqlagent
sqladhlp
Culserver
RTVscan (Symantec Antivirus Program)
sqlbrowser
SQLADHLP
QBIDPService (QuickBooksby Intuit.)
QuickBoooks.FCS (QuickBooksby Intuit.)
QBCFMonitorService (QuickBooksby Intuit.)
sqlwriter
msmdsrv (Microsoft SQL Server Analysis or Microsoft SQL Server)
tomcat6 (Apache Tomcat)
zhundongfangyu (this belongs to the 360 security product from Qihoo company)
vmware-usbarbitator64
vmware-converter
dbsrv12 (Creates, modifies, and deletes SQL Anywhere services.)
dbeng8 (Sybase’s Adaptive Server Anywhere version 8 database program)
wrapper (Java Service?)

If one of these services is found by the malware querying the status of it, with the function “QueryServiceStatusEx”, LockBit will get all the depending modules when correct and safe and it will stop the service with the function “ControlService”.

The ransom note is rather compact because the author hardcoded the content right in the code without using any obfuscation or encryption. The text file containing the ransom note is created in every directory after encryption and called Restore-My-Files.txt.

Protection

Identity Theft Concerns Rise As 48.6 Million T-Mobile Customers Data Exposed in Breach

Post On: 27 August, 2021 By : Brad Hawkins

Identity theft concerns are being raised among T-Mobile Customers as the telecommunications company disclosed they suffered a colossal data breach in which 48.6 Million individuals had information exposed by hackers. The attacks breached T-Mobile servers and stole files containing the personal information of tens of millions of customers.

The breach impacts 7.8 million T-Mobile postpaid customers, 850,000 T-Mobile prepaid users, and approximately 40 million former or prospective ones. In total, the attackers stole records of 48.6 million individuals.

“Importantly, no phone numbers, account numbers, PINs, passwords, or financial information were compromised in any of these files of customers or prospective customers,” T-Mobile said in a press release.

“Some of the data accessed did include customers’ first and last names, date of birth, SSN, and driver’s license/ID information for a subset of current and former postpay customers and prospective T-Mobile customers.”

While the company has put importance on phone numbers not being exposed, the success of identity theft hangs on information like SSNs, dates of birth, and driver’s license/ID information – All items that were exposed in the attack and are likely already for sale on the Dark Web.
to current or prospective T-Mobile customers.

“At this time, we have also been able to confirm approximately 850,000 active T-Mobile prepaid customer names, phone numbers, and account PINs were also exposed. We have also confirmed that there was some additional information from inactive prepaid accounts accessed through prepaid billing files.” the carrier added.

T-Mobile has reset all PINs for affected accounts to prevent takeover attempts and is currently notifying these users.

The company has issued a list of steps in its press report to protect individuals who may experience identity theft.

“Immediately offering 2 years of free identity protection services with McAfee’s ID Theft Protection Service.
Recommending all T-Mobile postpaid customers proactively change their PIN by going online into their T-Mobile account or calling Customer Care team by dialing 611 on your phone. This precaution is despite the fact that we have no knowledge that any postpaid account PINs were compromised.
Offering an extra step to protect your mobile account with our Account Takeover Protection capabilities for postpaid customers, which makes it harder for customer accounts to be fraudulently ported out and stolen.
Publishing a unique web page later on Wednesday for one stop information and solutions to help customers take steps to further protect themselves.”

T-Mobile confirmed the claims of the hacker selling the database containing information. Not only can hackers use the details for traditional identity theft, they can also use stolen data or SIM swapping attacks, allowing them to take over other online accounts belonging to the victims.

It is advised that T-Mobile customers should be on the lookout for suspicious emails, calls, or texts from entities pretending to be the telecommunications company.

This is the sixth major data breach suffered by T-Mobile in just four years, the others being:

In 2018, info belonging to millions of T-Mobile customers was accessed by hackers.
In 2019, T-Mobile exposed prepaid customers’ data.
In March 2020, hackers gained access to T-Mobile employees’ email accounts.
In December 2020, hackers accessed exposed customer proprietary network information (phone numbers, call records).
In February 2021, threat actors targeted up to 400 customers in SIM swap attacks after gaining access to an internal T-Mobile application.

The Dangers of Identity Theft

Identity Theft can be absolutely devastating for an individual. Usually, in the world of malware, we know certain things can be harmed. Our devices may need to be replaced, we may lose access to accounts for a few days or even forever, we may even need to pay a ransom for access to our data. The point is, with most types of Malware, we can eventually rebuild, though it may take longer than we anticipate. The fallout from identity theft is much longer.

Once your stolen information is used once, it can take anywhere from a few days to six months for that one incident. But your information is out there for a very, very long time. This means you could end up dealing with identity theft for many years, even decades.

Identity Theft has been around for a very long time and predates our modern technology by thousands of years. There have always been individuals that try to impersonate others for their own gain, financial or otherwise. However, the internet’s birth and wide adoption have led to new attack vectors, dwarfing any possible past attempts.

Now more than ever do we have data tied into our personal identity. Email addresses, banking numbers, phone numbers, social security numbers, home addresses – All of these and more form a picture of us as lines in a database.

And when this information falls into the wrong hands, it can do a lot of damage. Bank accounts can be drained, and your credit rating can get rattled; you can end up with medical bills or even a criminal record. The list of potential mishaps that can arise from identity theft is endless.

To hackers, identity theft represents a lucrative stream of income, and they can very easily cover their tracks. After they have seized personal information, they sell it on the dark web. This information can be sold over time, repeatedly, meaning that if you notice your identity has been stolen and used, it can be used in several instances over a long period of years.

There are some guidelines from the US government in discovering if you are a victim of identity theft if it is not immediately obvious:

You stop receiving your regular bills and credit card statements.
You receive statements for accounts you never opened.
Debt collectors start calling you day and night about debts you’ve never heard of.
The IRS alleges you failed to report income for a company you never worked for.
You see withdrawals/charges on your bank or credit card statement that you didn’t make.
You try to file your taxes only to discover that someone else beat you to it.
You try to file your taxes and find someone claimed your child as a dependent already.
Your credit report includes lines of credit you never opened.
Your credit score fluctuates wildly and for no apparent reason.
The most obvious sign—you receive a notification that you’ve been the victim of a data breach.
If you are unsure, it is always best to check with the authorities on the US government’s identity theft website.

Protection

In some cases, a victim cannot be faulted for identity theft. For example, those affected by the data breach handed their information over to companies in good faith in the story above. Unfortunately, these companies, or more specifically the vendor, failed in protecting this information. However, many other times, business owners and families are singled out and targeted in their offices and homes.

For times like these, it is critical that you have the right tools to protect yourself. One of these tools is SaferNet.

MountLocker Ransomware Now Abusing Windows Active Directory To Propagate Through Network

Post On: 19 June, 2021 By : Brad Hawkins

MountLocker Ransomware is undergoing continuous development and is now using Windows Active Directory APIs to worm through networks it infects. MountLocker began life in July 2020 as Ransomware-as-a-Service (RaaS), where developers create strains of malware and lease them out to other hackers to use on businesses and organizations. The RaaS market is highly competitive, and MountLocker Ransomware has been making a name for itself as one of the best. As part of the business arrangement, the MountLocker Ransomware team gets a cut of about 25% of every ransom, while affiliates bag the remaining 75%. Different RaaS manufacturers have different terms, but a divide similar to this is most common.

In March 2021, a new group ransomware group emerged called ‘Astro Locker‘ that began using a customized version of the MountLocker ransomware with ransom notes pointing to their own payment and data leak sites. This was thought by many in the cybersecurity community to be some sort of rebranding by the developers.

In a statement to BleepingComputer, Astro Locker said, “”It’s not a rebranding, probably we can define it as an alliance”.

Astro Locker appeared as a more sophisticated version of MountLocker Ransomware. In May 2021, an even newer version appeared – XingLocker.

The sample was shared by MalwareHunterTeam on Twitter and further analyzed by BleepingComputer. Both confirmed that the sample contains a new worm feature that allows it to spread and encrypt to other devices on the network. The worm can be enabled by running the malware sample with the /NETWORK command-line argument, meaning it could still be in a state of very early development.

The sample was sent to Advanced Intel CEO Vitali Kremez, who discovered that MountLocker is now using the Windows Active Directory Service Interfaces API as part of its worm feature.

MountLocker ransomware first uses the NetGetDCName() function to retrieve the name of the domain controller. Then it performs LDAP queries against the domain controller’s ADS using the ADsOpenObject() function with credentials passed on the command line.

Using the Active Directory Service Interfaces API

Once it connects to the Active Directory services, it will iterate over the database for objects of ‘objectclass=computer’, as shown in the image above.

For each object it finds, MountLocker will attempt to copy the ransomware executable to the remote device’s ‘\C$\ProgramData’ folder.

MountLocker ransomware will then remotely create a Windows service that loads the executable so it can proceed to encrypt the device.

Creating and launching the ransomware service

Using this API, MountLocker ransomware can find all devices that are part of the compromised Windows domain and encrypt them using stolen domain credentials.

“Many corporate environments rely on complex active directory forests and computer within then. Now MountLocker is the first known ransomware to leverage unique corporate architectural insight for the benefit of identifying additional targets for encryption operation outside of the normal network and share scan,” Kremez stated

“This is the quantum shift of professionalizing ransomware development for corporate network exploitation.”

As Windows network administrators commonly use this API, Kremez believes the threat actor who added this code likely has some Windows domain administration experience.”

While this API has been seen in other malware, such as TrickBot, this may be the first “corporate ransomware for professionals” to use these APIs to perform built-in reconnaissance and spreading to other devices.

MountLocker Ransomware Analysis

This analysis was carried out by independent ransomware researcher Zawadi Done.

For encryption, MountLocker ransomware uses Chacha20 to encrypt files and RSA-2048 to encrypt the encryption key. But before the encryption procedure runs, MountLocker ransomware performs a few tasks that increase the effectiveness of the ransomware.

Both files are packed with a packer written in Visual Basic. The packer checks if the process is being debugged using IsDebuggerPresent if not it continues to unpack the executable into a created segment. Using x64dbg and PE-bear I dumped the full executable from memory and modified the image base and section headers.

The serial number of the used drive is retrieved and used as mutex value. Every time an encrypted file is opened the recovery manual of the ransomware is also opened.

To run a Powershell script it will create a file in the temporary folder C:\Users\IEUser\AppData\Local\Temp\.tmp and write a Powershell script to the file shown belown.

The Powersehll script is then executed by calling:

powershell.exe -windowstyle hidden -c $mypid=’972′[System.IO.File] :: ReadAllText (‘C:\Users\IEUser\AppData\Local \Temp\~1399171.tmp’)|iex”)

This results in the shadow copies being deleted and a list of services and processes being stopped.

Using the API calls CryptAcquireContextW, CryptImportKey, CryptEncrypt an embedded RSA-2048 key is imported and used to encrypt 32 bytes generated by the instruction rdtsc. The plaintext and ciphertext of the bytes will later be used to encrypt other values. MountLocker ransomware will search for all types of drives and it skips the following file extensions and directories.

Using CreateFileW and CreateFileMappingW it creates a filehandle and a handle to the file in memory. Instead of using MoveFileW to change the file name, it uses the SetFileInformationByHandle to change the extension of the file.

Using Chacha20 file_32_bytes will be encrypted with 32_bytes as key and the first 12 bytes of 32_bytes as the nonce. Let’s call the ciphertext encrypted_32_bytes. Then it writes file_encrypted_32_bytes and encrypted_32_bytes to the end of the file that will be encrypted.

Using MapViewOfFile the file is mapped in memory with as length the files size or 0x4000000 bytes. This buffer will then be encrypted with Chacha20 using file_32_bytes as key and the first 12 bytes of file_32_bytes as the nonce. After the buffer is encrypted it calls MapViewOfFile to store the buffer to the file on disk.

The encryption procedure is described in the diagram below.

After the files are encrypted, MountLocker ransomware will delete itself.

The MountLocker ransomware drops a ransom note in every folder that it encrypts with the name RecoveryManual.html. This note includes a ClientId which can be used to contact the threat actor on their own “support” portal. This ClientId is based on the computer name XOR’ed by a hardcoded value.

Protection

With threats like Mount Locker Ransomware evolving and expanding everyday, it is important individuals and business owners have adequate protection tools to keep their devices safe. One of these tools is SaferNet.

QNAP confirms devices still under assault by Qlocker Ransomware

Post On: 19 June, 2021 By : Brad Hawkins

Qlocker Ransomware remains a thorn in the side of network-storage company QNAP, who are now advising customers up update their Hybrid Backup Sync (HBS 3) disaster recovery app as it has become a backdoor for the ransomware strain. The recovery app is a feature of QNAPs’ Network-attached-storage (NAS) devices, which Qlocker ransomware has been targeting. “The ransomware known as Qlocker exploits CVE-2021-28799 to attack QNAP NAS running certain versions of HBS 3. To prevent infection from Qlocker, we recommend updating HBS 3 to the latest version.” the Taiwan-based NAS appliance maker said in a security advisory issued last week.

QNAP Systems is a Taiwanese corporation that specializes in Network-attached storage appliances used for file sharing, virtualization, storage management and surveillance applications. Headquartered in Xizhi District, New Taipei City, Taiwan, QNAP has offices in 16 countries and employs over 1000 people around the world.

QNAP’s problems with Qlocker ransomware began on April 19, when the company were attacked by a devastating ransomware campaign. Qlocker ransomware breaches thousands of QNAP NAS devices, replacing victims’ files with password-protected 7-zip archives.

At the time, the attack vector for Qlocker ransomware was unknown. Since then, QNAP has confirmed that the hackers abused the CVE-2021-28799 hard-coded credentials vulnerability. This flaw acts as a backdoor accounts, and allows attacks to access devices running out-of-date HBS 3 versions.

QNAP added that CVE-2021-28799 has already been fixed in the following HBS 3 versions (HBS 2 and HBS 1.3 are not impacted):

QTS 4.5.2: HBS 3 v16.0.0415 and later
QTS 4.3.6: HBS 3 v3.0.210412 and later
QTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later
QuTS hero h4.5.1: HBS 3 v16.0.0419 and later
QuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later

Though this is not the first time QNAP specifically mentioned Qlocker Ransomware targeting the HBS 3 backdoor, it is the first time that company have stated that this method is the primary attack vector.

For many of QNAP’s customers, these warnings come much too late. 5 weeks after the initial attacks, the campaign has slowed down considerably – the hackers have already made off with the money.

In these 5 weeks, hackers stole over $350,000 from users, forcing them to pay 0.01 bitcoins (about $500) to obtain the password for their files. This is a relatively low ransom amount but stretched out over the entire userbase to adds up to a considerable payday. Lower ransom amounts such as these also give a hacker’s campaign a higher chance of success.

It is believed the hackers behind Qlocker Ransomware also wanted to make an abrupt end to the campaign instead of continuing to infect new users. Cybersecurity researchers have confirmed that Qlocker TOR sites on the darkweb are no longer accessible, with the gang apparently vanishing.

These actions are following a new trend – Since the Darkside attack on the Colonial Pipeline, ransomware gangs are going offline or laying low for now. It is believed that the attack has drawn unwanted attention to the world of cybercrime, so gangs are forced to play it safe.

While Qlocker ransomware might have shut down, this is not the only ransomware currently targeting QNAP NAS devices. During the last few weeks, QNAP customers were also urged to secure their devices against new Agelocker and eCh0raix ransomware campaigns.

QNAP has released a list of best practice steps for customers to secure their NAS devices, which can be found here.

Qlocker Ransomware Anaylsis

Note: The Analysis of Qlocker Ransomware was carried out by cybersecurity researchers at BleepingComputer.

The attackers use 7-zip to move files on QNAP devices into password-protected archives. While the files are being locked, the QNAP Resource Monitor will display numerous ‘7z’ processes which are the 7zip command-line executable.

When the ransomware has finished, the QNAP device’s files will be stored in password-protected 7-zip archives ending with the .7z extension. To extract these archives, victims will need to enter a password known only to the attacker.

After QNAP devices are encrypted, users are left with a !!!READ_ME.txt ransom note that includes a unique client key that the victims need to enter to log into the ransomware’s Tor payment site.

From the Qlocker ransom notes seen by BleepingComputer, all victims are told to pay 0.01 Bitcoins, which is approximately $557.74, to get a password for their archived files.

After paying the ransom and entering a valid Bitcoin transaction ID, the Tor payment site will display the password for the victim’s 7Zip archives, as shown below.

During the research, independent security researcher Jack Cable reached out to Bleeping Computer about a bug he discovered in the Qlocker Tor site that allowed users to recover their 7zip passwords for free.

Sadly, within an hour of announcing the bug, Qlocker Ransomware operators made a hotfix, removing the flaw. In that time, at least some victims files were freed.

At this point, there is no way to recover the files without a password, which can no longer be retrieved for free.

The Qlocker threat actors exploit vulnerabilities in QNAP devices that allow them to execute commands on your NAS device remotely.

While most ransomware operations deploy specially crafted malware programs, the Qlocker attackers are simply scanning for QNAP devices and using vulnerabilities to remotely launch the built-in 7zip archive utility to password-protect files.

With this type of attack, QNAP devices are not being infected with any malware but simply being abused by vulnerabilities taking advantage of software already bundled with the operating system.

Protection

In cases like Qlocker Ransomware, we see supply-chain vulnerabilities, where a weak link in the software pipeline can affect an entire network. These attacks are becoming more and more common, and it is important that business leaders and home owners use the right tools to protect themselves from evolving threats. One of these tools is SaferNet.

Hackers Aim To Capitalize On Post-Covid Return To Office With Phishing Scheme

Post On: 19 June, 2021 By : Brad Hawkins

Phishing campaigns nearly always spike with any major event, and the post-covid return to office is proving to be no different. As if anticipating the shift back to the office, threat actors have been preparing sophisticated spear-phishing ploys to gain access to credentials illegitimately. This latest scam includes firing targets with emails purportedly from their CIOs welcoming workers back into offices. The phishing email supposedly outlines the company’s post-pandemic cubicle protocols.

“The body of the email appears to have been sent from a source within the company, giving the company’s logo in the header, as well as being signed spoofing the CIO,” Cofense outlined in a report.

The fake newsletter explains return-to-work procedures are forcing employees to take new precautions relative to the pandemic, according to the researchers.

The spoofed CIO email prompts victims to link to a fake Microsoft SharePoint page with two company-branded documents, both outlining new business operations. Eventually, the scam will lead the victim to handing over their credentials.

COVID-19 has been a treasure-trove for hackers in every stage of the pandemic. Spear-phishing vaccine-related attacks shot up 26% between October and January, just as the news of the vaccine came and the rollout began globally. Healthcare organisations, crushed under the weight of the pandemic, were targeted night and day by various forms of Malware. Last year alone, 10% of all organisations hit by ransomware were hospitals or medical organisations.

“COVID-19 has given us a window into how hackers can exploit human vulnerabilities during a crisis, with healthcare and pandemic-related attacks prevalent in 2020,” Sivan Tehila with Perimeter 81 wrote recently in a report for Threatpost.

CIO Spear-Phishing Attack Methodology

This attack campaign has been analysed by cybersecurity researchers at CoDefense.

The body of the email appears to have been sent from a source within the company, giving the company’s logo in the header, as well as being signed spoofing the CIO. By pretending to be an executive, the threat actor has sent a false newsletter explaining the new precautions and changes to business operations the company is taking relative to the pandemic.

It is likely in these times that many companies are making changes to their operations and providing their employees guidelines. However, in this case, the threat actor is trying to capitalize on sometimes confusing change to steal credentials and personal information.

If an employee were to interact with the email, they would be redirected to what appears to be a Microsoft SharePoint page with two documents. These documents appear to be legitimate, outlining changes to business operations referenced in the original email. Instead of simply redirecting to a login page, this additional step adds more depth to the attack and gives the impression that they are actual documents from within the company. When interacting with these documents, it becomes apparent that they are not authentic and instead are phishing mechanisms to garner account credentials.

Clicking on either of the documents produces a login panel that prompts the recipient to provide login credentials to access the files. This is uncommon among most Microsoft phishing pages where the tactic of spoofing the Microsoft login screen opens an authenticator panel. By giving the files the appearance of being real and not redirecting to another login page, the user may be more likely to supply their credentials in order to view the updates.

Another technique that the threat actor uses that we have seen in other campaigns is the use of fake validated credentials. For this example, the first few times login information is entered into the panel, the result will be the error message, “Your account or password is incorrect.”

After entering login information a few times, the employee will be redirected to an actual Microsoft page. This gives the appearance that the login information was correct, and the employee now has access to the OneDrive documents. In reality, the threat actor now has full access to the account owner’s information. Thus, the phishing attack has been successful.

Protection Against Phishing

Often in hacker circles some claim to have a sense of ‘honor amongst thieves’, but the COVID-19 Pandemic and the associated hacking campaigns that went on during it are a sure sign that these individuals do not have a clear sense of right and wrong. As the world gradually readjusts to the ‘normal’ we once knew, hackers are certain to use every tool at their disposal to steal information from whomever they target. Phishing attacks like these will continue to be widespread.

It is important that business owners use the rights tools to protect them against cyberthreats. One of these tools is SaferNet.

Second Largest Meat Producer in the US Under Assault By REvil Ransomware

Post On: 19 June, 2021 By : Brad Hawkins

REvil Ransomware extends its reputation as the world’s deadliest malware in an attack that occurred over the weekend on JBS foods. JBS is the second-largest meat producer in the US and the largest meat producer globally. Plants across the world have had to be shut down following the REvil Ransomware infection. The plants include those in the US, Australia, Canada, the UK, and Mexico. The company has a team of 245,000 employees around the world, serving an extensive portfolio of brands including Swift, Pilgrim’s Pride, Seara, Moy Park, Friboi, Primo, and Just Bare to customers from 190 countries on six continents.

JBS USA issued a press release on May 31st confirming the ransomware attack. “On Sunday, May 30, JBS USA determined that it was the target of an organized cybersecurity attack, affecting some of the servers supporting its North American and Australian IT systems,” JBS USA said.

“The company took immediate action, suspending all affected systems, notifying authorities and activating the company’s global network of IT professionals and third-party experts to resolve the situation. The company’s backup servers were not affected, and it is actively working with an Incident Response firm to restore its systems as soon as possible.”

The company added that there was no evidence of customer, supplier, or employee data compromised during the REvil ransomware attack.

The company also expects transactions with customers and suppliers to be delayed until the incident is fully resolved.

The Australian government has also been informed of the incident and is currently working with JBS to bring back online production facilities around the country.

“The technology they use goes to the heart of the quality assurance of the beef they are processing,” Australia’s Agriculture Minister David Littleproud told ABC. “We need to make sure we can get that up and going to give confidence not just to consumers in Australia, but also to our export markets. They are obviously working with law enforcement agencies here in Australia, and we’re working in partnership with other countries to get to the bottom of this. Since it is a global attack it’s important not to speculate that it’s emanated from any particular place, just yet.”

The US Department of Agriculture has said it expects beef prices to climb 1 percent to 2 percent this year, poultry as much as 1.5 percent, and pork between 2 percent and 3 percent.

If JBS were to shut down for even one day, the U.S. would lose almost a quarter of its beef-processing capacity, or the equivalent of 20,000 beef cows, according to Trey Malone, an assistant professor of agriculture at Michigan State University.

JBS did not say which of its 84 US facilities were closed on Monday and Tuesday because of the attack.

Earlier, a union official confirmed that two shifts at the company’s largest US beef plant, in Greeley, Colorado, were canceled. Some plant shifts in Canada were also canceled Monday and Tuesday, according to JBS Facebook posts.

The attack vector and malware strain used was initially unknown. On Tuesday, the White House announced the attack came from Russia. By Wednesday, the FBI released a short statement confirmed the malware strain to be REvil Ransomware.

“As the lead federal investigative agency fighting cyber threats, combating cybercrime is one of the FBI’s highest priorities. We have attributed the JBS attack to REvil and Sodinokibi and are working diligently to bring the threat actors to justice,” the agency said.

“We continue to focus our efforts on imposing risk and consequences and holding the responsible cyber actors accountable. Our private sector partnerships are essential to responding quickly when a cyber intrusion occurs and providing support to victims affected by our cyber adversaries.

“A cyber attack on one is an attack on us all. We encourage any entity that is the victim of a cyber attack to immediately notify the FBI through one of our 56 field offices.”

REvil Ransomware Analysis

REvil Ransomware is a Ransomware-as-a-Service (RaaS), meaning it can be sold on a subscription basis and is usable by just about anybody. In 2020, it extorted large amounts of money for corporations and individuals. According to researchers, it is the most widespread ransomware strain. Groups using have a knack for shaking down businesses that don’t meet their demands, often through threats or leaking dating.

REvil Ransomware, also known as Sodinokibi, first appeared in April 2019 and rose to prominence after another RaaS gang called GandCrab shut down its service. REvil was first advertised on Russian-language cybercrime forums. The main actor associated with advertising and promoting REvil ransomware is called Unknown aka UNKN. In the early days of REvil, researchers and security firms identified it as a strain of GandCrab, or at least established multiple links between the two. An alleged member of the group, using the handle Unknown, confirmed in an interview that the ransomware was not a new creation and that it was built on top of an older codebase that the group acquired.

The group behind REvil Ransomware and other groups selling RaaS often do so on a commission basis. Usually, this means a cut of between 20% and 30% of the money earned through infecting victims with ransomware.

In 2020, the IBM Security X-Force Incident Response reported that 1 in 3 Ransomware infections were caused by REvil Ransomware.

In February 2021, the REvil ransomware operation posted a job notice where they were looking to recruit people to perform DDoS attacks and use VOIP calls to contact victims and their partners.

In March, a security researcher known as 3xp0rt discovered that REvil has announced that they were introducing new tactics that affiliates can use to exert even more pressure on victims.

These new tactics include a free service where the threat actors, or affiliated partners, will perform voice-scrambled VOIP calls to the media and victim’s business partners with information about the attack. The ransomware gang is likely assuming that warning businesses that their data may have been exposed in an attack on of their partners, will create further pressure for the victim to pay.

REvil Ransomware is also providing a paid service that allows affiliates to perform Layer 3 and Layer 7 DDoS attacks against a company for maximum pressure. A Layer 3 attack is commonly used to take down the company’s Internet connection. In contrast, threat actors would use a Layer 7 attack to take down a publicly accessible application, such as a web server.

It is highly configurable, and it can be customized to behave differently depending on the host. This makes it a highly attractive RaaS client. Some of its features include:

Exploits a kernel privilege escalation vulnerability to gain SYSTEM privileges using CVE-2018-8453.
Whitelists files, folders and extensions from encryption.
Kills specific processes and services prior to encryption.
Encrypts files on local and network storage.
Customizes the name and body of the ransom note, and the contents of the background image.
Exfiltrates encrypted information on the infected host to remote controllers.
REvil Ransomware uses Hypertext Transfer Protocol Secure (HTTPS) for communication with its controllers.

REvil ransomware exploits a kernel privilege escalation vulnerability in win32k.sys tracked as CVE-2018-8453 to gain SYSTEM privileges on the infected host. If the configuration instructs a sample to execute this exploit, it will allocate executable memory, decrypt the exploit code in the newly allocated region and invoke it.

Protection Against Ransomware

REvil Ransomware and other Ransomware clients are some of the most common and deadly cybersecurity threats out there today. Families and businesses should be aware of these threats, and equip the right tools to tackle them. One of these tools is SaferNet.

A New Threat Emerges as Epsilon Red Ransomware Aims for Microsoft Vulnerabilities

Post On: 19 June, 2021 By : Brad Hawkins

Epsilon Red Ransomware is an explosive newcomer to the malware and ransomware scene and has been seen leveraging Microsoft Exchange server vulnerabilities to encrypt machines across the network. Epsilon Red Ransomware attacks rely on several scripts before reaching the encryption stage, and the strain is also notable for using a commercial remote desktop utility. Incident responders at cybersecurity company Sophos discovered the new Epsilon Red ransomware over the past week while investigating an attack at a fairly large U.S. company in the hospitality sector.

The researchers found that the threat actor breached the enterprise network by exploiting unpatched vulnerabilities in on-premise Microsoft Exchange server. Andrew Brandt, principal researcher at Sophos, says in a report today that the attackers may have leveraged the ProxyLogon set of vulnerabilities to reach machines on the network.

The ProxyLogon bugs have been widely publicized as hackers jumped at the occasion and started to scan the web for vulnerable devices and compromise the systems.

On March 2, Microsoft released critical security updates for four crucial zero-day vulnerabilities discovered in Exchange Servers and reported that the exploits are being actively exploited by an actor called HAFNIUM, a state-sponsored group operating out of China.

Within one week, at least 30,000 U.S. organizations and hundreds of thousands of organizations worldwide have fallen victim to an automated campaign run by HAFNIUM that provides the attackers with remote control over the affected systems.

Researches at Radware have listed the Proxy Logon exploits as follows:

CVE-2021-26855: SERVER SIDE REQUEST FORGERY
The Server-Side Request Forgery (SSRF) vulnerability provides a remote actor with admin access by sending a specially crafted web request to a vulnerable Exchange Server. The web request contains an XML SOAP payload directed at the Exchange Web Services (EWS) API endpoint. The SOAP request bypasses authentication using specially crafted cookies and allows an unauthenticated, remote actor to execute EWS requests encoded in the XML payload and ultimately perform operations on users’ mailboxes. This vulnerability, combined with the knowledge of a victim’s email address, means the remote actor can exfiltrate all emails from the victim’s Exchange mailbox.

Organizations that received this letter were companies that received threats in August and September of 2020. Analysis of this new wave of ransom letters suggests that the same threat actors from the middle of 2020 are behind these malicious communications.

CVE-2021-26857: REMOTE CODE EXECUTION VULNERABILITY
A post-authentication insecure deserialization vulnerability in the Unified Messaging service of a vulnerable Exchange Server allows commands to be run with SYSTEM account privileges. The SYSTEM account is used by the operating system and services that run under Windows. By default, the SYSTEM account is granted full control permissions to all files. A malicious actor can combine this vulnerability with stolen credentials or with the previously mentioned SSRF vulnerability to execute arbitrary commands on a vulnerable Exchange Server in the security context of SYSTEM.

CVE-2021-26858 AND CVE-2021-27065
Both of these post-authentication arbitrary file write vulnerabilities allow an authenticated user to write files to any path on a vulnerable Exchange Server. A malicious actor could leverage the previously mentioned SSRF vulnerability to achieve admin access and exploit this vulnerability to write web shells to virtual directories (VDirs) published to the internet by the server’s Internet Information Server (IIS). IIS is Microsoft’s web server, a dependency that is installed with Exchange Server and provides services for Outlook on the web, previously known as Outlook Web Access (OWA), Outlook Anywhere, ActiveSync, Exchange Web Services, Exchange Control Panel (ECP), the Offline Address Book (OAB) and Autodiscover.

Epsilon Red Ransomware Analysis

Note: The Analysis of Epsilon Red Ransomware has been carried out by Sophos and BleepingComputer.

Epsilon Red Ransomware is written in Golang (Go) and is preceded by a set of unique PowerShell scripts that prepare the ground for the file-encryption routine, each having a specific purpose:

kill processes and services for security tools, databases, backup programs, Office apps, email clients
delete Volume Shadow Copies
steal the Security Account Manager (SAM) file containing password hashes
delete Windows Event Logs
disable Windows Defender
suspend processes
uninstall security tools (Sophos, Trend Micro, Cylance, MalwareBytes, Sentinel One, Vipre, Webroot)
expand permissions on the system
Most of the scripts are numbered 1 through 12 but there are a few that are named as a single letter. One of these, c.ps1, seems to be a clone of the penetration testing tool Copy-VSS.

Powershell scripts before Epsilon Red Ransomware takes hold

fter breaching the network, the hackers reach machines over RDP and use Windows Management Instrumentation (WMI) to install software and run PowerShell scripts that ultimately deploy Epsilon Red Ransomware executable.

Sophos researchers noticed that the threat actor also installs a copy of Remote Utilities – a commercial software for remote desktop operations, and the Tor Browser. This move is to ensure that they still have a door open if they lose access through the initial entry point.

The ransomware itself, called RED.exe, is a 64-bit Windows executable programmed in the Go language, compiled using a tool called MinGW, and packed with a modified version of the runtime packer UPX.

The executable contains some code taken from an open source project called godirwalk, which gives it the ability to scan the hard drive on which it’s running for directory paths and compile them into a list. The ransomware then spawns a new child process that encrypts each subfolder separately, which after a short amount of time results in a lot of copies of the ransomware process running simultaneously.

Epsilon Red Ransomware itself is quite small as it only really is used to perform the encryption of the files on the targeted system. It makes no network connections, and because functions like killing processes or deleting the Volume Shadow Copies have been outsourced to the PowerShell scripts, it’s really a simple program.

In the sample Sophos saw, it doesn’t even contain a list of targeted file types or file extensions. In fact, it will encrypt everything inside the folders it decides to encrypt, including other executables and DLLs, which can render programs or the entire system nonfunctional, if the ransomware decides to encrypt the wrong folder path. After it encrypts each file, it appends a file suffix of “.epsilonred” to the files, and drops a ransom note in each folder.

Strangely enough, the Epsilon Red Ransomware note closely resembles the note used by REvil, a much more widely used ransomware. But where the REvil note is typically riddled with spelling and grammatical errors, the note delivered by Epsilon Red Ransomware has gone through a few edits to make its text more readable to an audience of native English speakers.

Victims are encouraged to visit a special URL on a website operated on the normal web (epsilons[.]red) to engage with the attackers.

Epsilon Red Ransomware is just one of many new malware strains being produced and developed almost daily. Families and businesses should be aware of these threats, and equip the right tools to tackle them. One of these tools is SaferNet.