Kasseika Ransomware Exploits Driver Functionality to Kill Antivirus

Ransomware is a tool that hackers use to extort money from their targets like individuals, businesses, and governments. The malware encrypts the target’s data and demands payment to unlock it.

This malicious strategy increases the possibility of payment by giving threat actors financial profits in the form of bitcoin in exchange for vital information.

Cybersecurity researchers at Trend Micro recently discovered that threat actors are actively exploiting the driver functionality to kill Antivirus programs.

Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Run Free Threat Scan

Kasseika Ransomware Kill’s Antivirus

In 2023, Kasseika ransomware joined the BYOVD trend, following Akira, BlackByte, and AvosLocker. They used Martini driver to disable antivirus programs that resemble the BlackMatter with pseudo-ransom extensions. 

This suggests a mature actor with access to BlackMatter’s source code previously linked to DarkSide and ALPHV. Since its 2021 shutdown, exclusive ransomware groups have adapted BlackMatter’s old code for new strains.

Kasseika ransomware employs targeted phishing for initial access by gathering credentials and using PsExec to move within the network. 

It exploits Martini.sys to disable security tools, which helps terminate processes and leverages FindWindowA API to detect security-related processes. 

The script ensures a clean state by setting up flexible variables for future use. Kasseika transfers files, terminates antivirus processes with Martini.exe, and also executes smartscreen_protected.exe as its ransomware binary. The Clear.bat is then executed to erase traces of the operation.

Kasseika ransomware is a Themida-packed 32-bit Windows PE file that employs robust obfuscation and anti-debugging. 

It terminates processes accessing Windows Restart Manager by modifying the registry keys and enumerating session hashes before encryption. 

It erases shadow copies using WMIC queries and decrypts its extension with Base64 encoding. Kasseika uses ChaCha20 and RSA from CryptoPP by generating a modified matrix for encryption. 

After renaming and dropping CBhwKBgQD.README.txt as a ransom note, Kasseika changes the system wallpaper post-encryption.

Kasseika ransomware employs wevutil.exe to discreetly wipe Application, Security, and System event logs that help in evading easy detection and response by security tools.

Recommendations

Here below we have mentioned all the recommendations:-

• Grant admin rights only when necessary.
• Regularly update security products and perform scans.
• Secure backups for critical data.
• Practice safe email and website habits.
• Encourage reporting of suspicious emails and files.
• Educate users on social engineering risks regularly.

Organizations can enhance security with a multilayered strategy by covering the endpoints, email, web, and network entry points. 

The detection of malicious components and suspicious behavior by security solutions is crucial for enterprise protection.