Daniel Osei — SOC Lead & Malware Analyst
Key Takeaways
- Ransomware deployed via phishing email led to significant network compromise.
- Utilization of T1059.001 – PowerShell for initial execution and payload delivery.
- Command and Control (C2) infrastructure employed a dynamic DNS service, complicating threat detection.
Executive Summary
In our recent investigation of a ransomware attack attributed to a notable threat actor, we observed a well-coordinated campaign beginning with targeted phishing emails. The adversaries leveraged social engineering to deliver malicious attachments, ultimately deploying a sophisticated ransomware variant. Our analysis revealed a campaign characterized by a rapid escalation from initial access to lateral movement, culminating in data encryption and ransom demands.
Initial Access
The initial access phase exploited a phishing strategy where tailored emails lured users into opening a document containing malicious macros. Upon enabling macros, the victim’s system executed a series of T1059.001 – PowerShell commands that downloaded the payload. The malicious PowerShell script was capable of bypassing common security measures by leveraging encoded commands and utilizing the Invoke-Expression method.
Execution & Persistence
The ransomware we examined, identified as REvil, employed various techniques to ensure persistence. Upon execution, it created a new service at C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\revil_service.exe, allowing the malicious process to start on system reboot. Additionally, it modified the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to establish persistence through Windows startup.
Command and Control
Our investigation uncovered a robust command and control (C2) mechanism. The malware communicated with its C2 server using HTTPS over TCP port 443, leveraging a dynamic DNS service that made tracking difficult. We identified traffic to a domain associated with an IP address that changed frequently, evidencing the actor’s efforts to evade detection. This level of obfuscation is indicative of a well-funded adversarial campaign.
Lateral Movement & Discovery
After establishing a foothold, the ransomware utilized T1557 – Adversary-Initiated Lateral Movement techniques for lateral movement across the network. We observed the tool executing PsExec to propagate laterally, taking advantage of existing administrative credentials. Furthermore, the malware employed T1046 – Network Service Scanning to identify additional hosts and gather information regarding system configurations to maximize impact.
Impact & Objectives
The primary objective of this ransomware campaign was to encrypt files on critical systems and demand a ransom via a lightweight ransom note, which typically redirected victims to a TOR-based payment site. The actors targeted sensitive data, which they threatened to publicly leak if the ransom was not paid. The impact was significant, with several organizations reporting downtime as well as financial losses attributed to operational disruptions and recovery costs.
MITRE ATT&CK Mapping
- T1059.001 – PowerShell: Execution of scripts via PowerShell to run malicious commands and download additional payloads.
- T1566 – Phishing: Delivery of a malicious document through social engineering tactics.
- T1053.003 – Scheduled Task/Job: Establishing persistence through the creation of a startup service.
- T1557 – Adversary-Initiated Lateral Movement: Utilizing network tools to facilitate lateral movement.
- T1046 – Network Service Scanning: Scanning for additional hosts to expand the attack surface.
Detection Opportunities
- Monitor for unusual PowerShell execution that includes encoded commands or uses
Invoke-Expression. - Analyze email patterns for signs of phishing, particularly the presence of malicious attachments or misleading URLs.
- Implement detection mechanisms for unexpected service installations and registry modifications associated with persistence techniques.
Analyst Notes
This incident highlights the critical need for robust email filtering solutions and user awareness training. Given the sophistication of the tactics employed, a multi-layered defense strategy combining endpoint detection, network monitoring, and user education is vital in building resilience against similar ransomware attacks. Continuous monitoring and the capability to conduct forensic investigations are essential for effective threat response and mitigation strategies.
Source: Original Report