Friday, November 1, 2024
HomeCyber Security NewsResearchers Uncover Series of Ransomware Attacks that Follow Same Pattern

Researchers Uncover Series of Ransomware Attacks that Follow Same Pattern

Published on

Malware protection

Ransomware groups often recycle tools, techniques, and procedures. Even some of them also provide playbooks for affiliates as well.

Numerous use Cobalt Strike for remote access, employ RDP brute force, and target Domain Controller servers to control network machines.

Cybersecurity researchers at Sophos X-Ops recently reported their investigation on ransomware attacks from Jan 2023 publicly, under which they examined four ransomware attacks.

- Advertisement - SIEM as a Service

They investigated the following attacks:-

  • One attack by Hive
  • Two attacks by the Royal
  • One attack by Black Basta

In these attacks, the most shocking thing that researchers unveiled publicly is they found several similarities in the attack pattern of these ransomware groups.

Patterns of Behavior

Here below we have mentioned all the patterns of behavior that are observed by the security analysts at Sophos MDR:-

  • Attackers crafted admin accounts on hijacked Domain Controller servers with non-random, unique usernames and complex passwords.
  • Applied steady tool persistence methods using identical names.
  • Utilized matching pre-deployment batch scripts to set up ransomware.
  • The final ransomware payload is deployed via a .7z archive named after the targeted organization. Here with the same password, the .7z archive is password-protected and executed with a matching shell command.

Ransomware Attacks that Follow the Same Pattern

What caught Sophos MDR’s attention was the inclusion of Royal ransomware in the attack cluster, a group known for exclusivity, avoiding outside “affiliate” attackers.

Royal ransomware ransom note (Source – Sophos)

A cluster doesn’t guarantee attribution, but in some scenarios, it could do the same with strong evidence. Shared behaviors don’t confirm the same attackers, but suggest a similar playbook, as Kroll Inc. analysis shows a fifth attack aligns with this cluster.

Here below we have mentioned the same batch scripts and files that are used:-

  • file1.bat
  • file2.bat
  • ip.txt
  • gp.bat

Threat actors use the Scheduled Tasks for the creation of persistence methods, and they name the tasks with the following types of names:-

  • Microsoft Update
  • Windows Update
  • Windows Update 1
  • Windows Update 2
  • Windows Sensor qe
  • Windows Sensor qe 1
Document
FREE Webinar

API Security Fundamentals: How to Discover, Scan and Protect APIs

API Attacks Have Increased by 400% – Understand the Fundamentals of Protecting Your APIs with a Positive Security Model – Register Now for a Free Webinar

Common Tools & Techniques

Common tools and techniques used:-

  • Network reconnaissance using Advanced Port Scanner
  • Extensive use of PowerShell commands converted into base64 strings
  • Installation of a secondary backup remote access with Cobalt Strike
  • Use of commercial tools like TeamViewer, WizTree, or Citrix Enterprise Browser
  • Lateral movement via Remote Desktop
  • Dumping the NTDS and Registry hive for credential extraction
  • Use of dual-use tools like PsExec
  • Payloads hosted on public services like Pastebin
  • Use of rclone to move off the system
  • For final protection evasion, threat actors reboot the systems into Safe Mode.

Logs from the Hive ransomware attack earlier this year against a target with a different endpoint security product revealed the first signs of the threat cluster behavior.

Examining these attacks reveals both similarities and key differences; however, the initial access methods differ, possibly due to Royal buying access from distinct Initial Access Brokers.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...