Mike Torres — Incident Response Specialist
Key Takeaways
- The recent ransomware attack leveraged phishing emails to gain initial access to corporate networks.
- Multiple techniques were employed for execution and persistence, including the use of scheduled tasks and registry modifications.
- Command and control was established via dynamic DNS, highlighting the actors’ need for redundancy in their infrastructure.
Executive Summary
During our analysis of a recent ransomware incident, we observed a sophisticated attack chain that targeted multiple sectors, employing various tactics throughout the lifecycle of the attack. The threat actors utilized phishing campaigns to gain a foothold, subsequently deploying a custom ransomware variant that encrypted files and exfiltrated sensitive data. Our investigation details the steps taken by the attackers as well as potential detection methods for defenders.
Initial Access
The initial entry point of the attack was a well-crafted phishing email sent to employees, containing a malicious link that redirected victims to a fake login page. This page was designed to steal credentials and deploy the malware once the user logged in. Traffic analysis revealed that the URL used was hosted on a dynamic DNS service, a common tactic to quickly change infrastructure if detected. The email headers contained forged “From” addresses that closely resembled legitimate sources, increasing the likelihood of user interaction.
Execution & Persistence
Once the actors gained access, they utilized a dropper that was executed via Office Macros. This dropper placed the main payload in a commonly used directory to evade detection, specifically in C:\Users\[Username]\AppData\Local\Temp\. Our analysis revealed that the ransomware implemented scheduled tasks to ensure persistence after reboots, creating entries in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to invoke the malware on startup. Additionally, modifications to various Windows Registry keys further maintained its presence.
Command and Control
The sample we examined established command and control (C2) using encrypted communications through a web socket connection to multiple dynamic IP addresses. Besides, the ransomware leveraged a list of hardcoded IP addresses for fallback mechanisms whenever it detected anomalies in communication. Our network traffic analysis identified regular beaconing to these domains, enabling the actors to send commands to the compromised systems for further actions, including data exfiltration.
Lateral Movement & Discovery
Following initial execution, the adversaries conducted lateral movement across the network using techniques such as T1075 – Pass the Hash and T1086 – PowerShell scripts to execute commands on other machines within the environment. They harvested credentials by leveraging tools like Windows Credential Editor and employed a number of browsing tactics to discover additional resources, such as shared drives and administrative tools, which were subsequently targeted for encryption.
Impact & Objectives
The ultimate objective of this campaign was twofold: encrypt data to deny access and exfiltrate sensitive information for future ransom threats. The ransomware was designed to encrypt files with specific extensions and to leave ransom notes demanding payment in cryptocurrency. Additionally, our investigation revealed that the payload attempted to exfiltrate sensitive files to a staging server controlled by the actor, which points towards a double extortion strategy where data is both locked and threatened to be released.
MITRE ATT&CK Mapping
- T1192 – Spear Phishing Link: Adversaries used phishing to direct victims to a fake login page to steal credentials.
- T1027 – Obfuscated Files or Information: The dropper utilized obfuscation techniques to evade detection.
- T1071 – Application Layer Protocol: C2 was conducted over standard web protocols to blend in with normal traffic.
Detection Opportunities
- Monitor for phishing emails with similar characteristics, including links to dynamic DNS domains.
- Implement endpoint detection to flag unauthorized modifications to
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Establish network analysis for C2 communication patterns consistent with ransomware behavior, particularly traffic to dynamic DNS and unexpected outbound connections.
Analyst Notes
This analysis highlights the evolving tactics used by ransomware actors, emphasizing the need for robust email filtering, continuous monitoring of system behavior, and the maintenance of a strong incident response strategy. Organizations should prioritize user training to identify phishing attempts and implement detection and response capabilities that cover the entirety of the attack chain.
Source: Original Report