Priya Nair — Digital Forensics Analyst
Key Takeaways
- Actors exploited a vulnerability in the organization’s email system for initial access.
- The malware deployed included the well-known REvil ransomware variant, enabling data exfiltration before encryption.
- Strategies for C2 communications involved multiple hops through cloud services to obfuscate origin.
Executive Summary
During our investigation of a recent ransomware incident affecting several financial institutions, we observed a sophisticated attack chain orchestrated by a threat actor group known for leveraging known vulnerabilities and phishing tactics. The sequence of events was meticulously executed, showcasing a mix of technical proficiency and organizational knowledge. The primary objective centered on data theft followed by encryption to demand ransom payments, showcasing the actor’s dual motivation of financial gain and potential reputational damage to the targeted organizations.
Initial Access
The initial access vector was traced back to a spear-phishing email sent to employees within the targeted financial institutions. Our analysis revealed that the email contained a malicious attachment masquerading as an invoice, which exploited the CVE-2021-26855 vulnerability in Exchange Server to gain a foothold within the network. Once the attachment was executed, it triggered a dropper that first established persistent backdoor access before executing further payloads.
Execution & Persistence
The sample we examined installed a remote access tool (RAT) commonly associated with ransomware deployments. Specifically, we identified the use of TeamViewer and AnyDesk applications to maintain persistent access to the compromised environment. Registry entries were modified to ensure the RAT would restart with system reboots, particularly through entries in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. This method of persistence was coupled with an automated task created via schtasks to periodically refresh the RAT.
Command and Control
Our investigation revealed a multi-layered Command and Control (C2) infrastructure. Initially, the implant communicated over HTTPs to a domain dynamically generated for each operation. We observed an interesting tactic where the actor incorporated legitimate cloud services, such as AWS and Google Cloud Platform, to obfuscate their network traffic. This set up allowed them to mask their C2 communications within seemingly benign data exchanges. Furthermore, Domain Generation Algorithms (DGAs) were employed, which significantly complicated our ability to pinpoint endpoint behavior.
Lateral Movement & Discovery
Following initial lockdown, the actor leveraged T1075 – Pass the Hash techniques to explore the internal network. Using credentials harvested via keylogging and credential dumping tools such as Mimikatz, the actor directed queries against Active Directory to discover additional vulnerable accounts. We noted several accounts with high privileges were targeted, indicating the actor’s objective was to broaden their access for lateral movement throughout the organization.
Impact & Objectives
The impact was significant, culminating in the encryption of critical files across multiple servers while simultaneously exfiltrating sensitive customer data. The data fished included personally identifiable information (PII) and financial records, which the actor threatened to release publicly should the ransom not be paid. The ransom demand was structured such that it increased over time, applying continuous pressure on the victims. Our analysis indicates that the primary objective was not only to extract payments but also to instigate fear among clients of the financial institutions affected.
MITRE ATT&CK Mapping
- T1190 – Exploit Public-Facing Application: Exploited CVE-2021-26855 for initial access via the company’s email system.
- T1071.001 – Application Layer Protocol: Web Protocols: Leveraged HTTP over cloud services for C2 communication.
- T1003.001 – Credential Dumping: OS-specific: Employed Mimikatz to extract user credentials from memory to facilitate lateral movement.
Detection Opportunities
- Monitor inbound email for common hash fingerprints associated with malicious attachments.
- Employ EDR solutions capable of detecting anomalous behavior related to the execution of scheduled tasks and registry modifications.
- Implement network monitoring to identify unusual outbound traffic patterns directed at known cloud service providers.
Analyst Notes
This incident reinforces the importance of a robust defensive posture against ransomware threats. Organizations must continually evaluate and strengthen security controls for email and endpoint protection while ensuring that incident response protocols are in place and tested regularly. Only through proactive threat hunting and active remediation can we truly mitigate the risk posed by these increasingly sophisticated actors.
Source: Original Report