Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- The REvil ransomware primarily utilized phishing emails for initial access.
- The malware exhibited advanced persistence mechanisms, leveraging both Registry Run Keys and scheduled tasks.
- Communication with the command and control servers was conducted via HTTPS, utilizing domain generation algorithms (DGA)
Executive Summary
Our investigation into a recent REvil ransomware campaign revealed a sophisticated operational technique that persisted through various lateral movement strategies and exhibited a robust command and control (C2) architecture. The threat actor demonstrated resilience and flexibility, deploying customized payloads that were tailored to the targeted environment. This analysis delves deeply into the attack chain, highlighting the various tactics, techniques, and procedures (TTPs) employed throughout the incident.
Initial Access
During our analysis, we observed that initial access was achieved via phishing emails containing malicious attachments designed to appear legitimate. The actors leveraged a combination of social engineering techniques to entice users to enable macros in Microsoft Office documents. Upon executing the macros, the initial payload—a dropper file—was downloaded from a remote server. The file was hosted on a clean domain to avoid scrutiny, revealing the careful preparation made by the actors.
Execution & Persistence
The sample we examined included multiple execution layers. Once executed, the dropper deployed the main REvil ransomware executable, which subsequently initiated the encryption process across network shares. Persistent mechanisms were intricately woven into the attack—from modifying HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run entries to create a silent startup behavior for the embedded payloads. Additionally, the malware configured Scheduled Tasks to ensure reinfection after reboots, significantly increasing its lifespan within targeted systems.
Command and Control
Our investigation revealed that the REvil ransomware accessed its command and control servers via HTTPS. The malware employed a DGA, generating a sequence of domains aimed at evading detection and ensuring redundancy. During the analysis, we noted that the malware would often switch domains during the attack, showcasing its adaptive capabilities. The stolen credentials and encrypted data were sent back to designated endpoints, where the actors could interact with the ransomware through a specific management interface.
Lateral Movement & Discovery
Lateral movement was observed using various Credential Dumping techniques, particularly through Mimikatz. The actor leveraged legitimate tools like PsExec to propagate the ransomware across the environment, exploiting weak password policies and misconfigurations. Our analysis highlighted specific endpoints that were critical for lateral movement based on their roles within the network architecture, allowing the actors to escalate privileges effectively. Furthermore, the use of Remote Desktop Protocol (RDP) sessions post-compromise allowed them to maintain access and control over infected machines.
Impact & Objectives
The REvil ransomware campaign aimed not only for financial gain through ransom payments but also sought to cause significant disruption to business operations. Our post-infection analysis indicated that once the ransomware executed its encryption routine, it rendered critical files and systems inaccessible, significantly impacting the organization’s workflows. The actors further threatened to publish sensitive data on dark web forums if the ransom was not paid, indicating a dual-layered extortion strategy that exacerbated the pressure on the victims.
MITRE ATT&CK Mapping
- T1059.001 – Command and Scripting Interpreter: PowerShell: Execution of malicious PowerShell scripts via macros.
- T1543.003 – Create or Modify System Process: Windows Service: Creation of new services for persistence.
- T1071.001 – Application Layer Protocol: Web Protocols: Communication with C2 over HTTPS.
Detection Opportunities
- Implement monitoring for unusual Registry modifications related to auto-start entries.
- Set up alerts for RDP login attempts from unusual locations or atypical hours.
- Deploy threat intelligence feeds focused on known DGA domains and monitor outbound HTTP/S traffic.
Analyst Notes
As we continue to analyze the REvil ransomware landscape, it’s crucial to remain vigilant and develop robust incident response plans tailored to mitigate the risks associated with ransomware attacks. The emphasis on persistence and lateral movement within the tactics employed by the actors necessitates a comprehensive approach to security hygiene, including multifactor authentication, regular patching of software vulnerabilities, and user awareness training.
Source: Original Report