Thursday, March 28, 2024

Robinhood Ransomware Borrow Vulnerable Driver To Kill Antivirus and Encrypt Windows System Files

Researchers observed a new ransomware family called “Robinhood” that using a digitally signed vulnerable driver to bypass the protection by killing files belonging to endpoint security products, bypassing tamper protection and antivirus software to encrypt the system files.

Attackers using the Living off the Land technique for this ransomware attack to destructive file encryption portion and they are using Gigabyte driver vulnerability tracked as CVE-2018-19320.

Living off the land tactics is the use of operating system features or legitimate network administration tools or drivers to compromise victims’ networks.

During the attack, the Gigabyte driver used by them to load an unsigned driver into Windows to bypass the security protection and killing the security software process.

Researchers from Sophos said ” This is the first time we have observed ransomware shipping a trusted, signed (yet vulnerable) third party driver to patch the Windows kernel in-memory, load their own unsigned malicious driver, and take out security applications from kernel space”

Robinhood Bypass Windows Defenses

Researchers found that the Robinhood ransomware using various strategies to killing the endpoint security software process before starting its encryption process.

Samples of this ransomware reveal that the attackers using several files embedded in STEEL.EXE and is extracted to C:\WINDOWS\TEMP.

Following list of files that performing various operations during the infection.

STEEL.EXE – The Kill application that kills the processes and files of security products, using kernel drivers.

ROBNR.EXE – A driver installer that deploys both the benign, signed third-party driver and the criminals’ unsigned kernel driver.

GDRV.SYS – Vulnerable kernel driver, an outdated Authenticode-signed driver

RBNL.SYS – Malicious kernel driver that can kill processes and delete files from the kernel space.

These malicious drivers have various ways to delete files, but it doesn’t choose only one way to perform this task, instead, it runs them all sequentially, to ensure the file gets deleted.

Once its deleted the files,  STEEL.EXE kills all the processes associated with the files and displays the following ransomware notes.

Eventually, all the files in the compromised systems will be locked with strong encryption and demand the $10, 000 ransom in bitcoin.

Also, the ransomware notes displayed, the link will be provided to unlock the device by getting the private key, and they also warned not to contact the FBI and other security organizations.

Also Read: Ransomware Attack Response and Mitigation Checklist

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles