Deep Dives

In-Depth Analysis of a Recent Ransomware Campaign Leveraging Phishing and Data Exfiltration Techniques

by n8n admin

Alex Morgan — Threat Intelligence Analyst

Key Takeaways

  • The actor employed a phishing campaign to deliver a custom ransomware payload.
  • Our analysis revealed the use of T1059.001 – PowerShell for initial execution.
  • Indicators of compromise (IOCs) included malicious IP addresses and specific registry changes that enabled persistence.

Executive Summary

This report delves into a recent ransomware incident observed within multiple organizations, showcasing a sophisticated use of phishing to gain initial access followed by strategic data exfiltration and eventual file encryption. The attack we investigated demonstrated a clear understanding of both the target environment and how to embed malicious actions within legitimate operations. Throughout the analysis, we noted several techniques from the MITRE ATT&CK framework employed by the threat actor, providing us with an intricate view of the tactics, techniques, and procedures (TTPs) utilized to achieve their objectives.

Initial Access

The initial access vector was traced back to a phishing email containing a malicious attachment disguised as an invoice. It utilized a macro-enabled Microsoft Word document, which, when opened by the victim, executed a Base64 encoded PowerShell script. This script downloaded the ransomware component from an external server, evidencing the use of T1203 – Exploitation for Client Execution and reinforcing the importance of user education regarding phishing attempts.

Execution & Persistence

Upon execution, the malware deployed several components to ensure persistence within the environment. We observed the creation of a scheduled task under C:\Windows\System32\Tasks\MyTask, executing the payload at regular intervals. Persistence was further cemented with registry modifications, specifically under HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, where a new entry was created to allow the ransomware to trigger upon user logon. This aligns with the T1547.001 – Registry Run Keys / Startup Folder technique.

Command and Control

Following infection, the implant established a command and control (C2) channel to receive commands and exfiltrate data. Our analysis identified anomalous DNS queries directed at a domain previously associated with known threat actors, indicating the use of T1071.001 – Application Layer Protocol: Web Protocols. The ransomware beaconed back using encrypted HTTP traffic, obscuring its activities amidst regular web traffic. This technique, while effective, raises flags on network traffic analysis.

Lateral Movement & Discovery

To propagate further within the organization, the actor leveraged stolen credentials gathered during the initial access phase. Utilizing tools such as Mimikatz, the attacker executed T1021.001 – Remote Services: Remote Desktop Protocol to lateral move across the network. Their reconnaissance phase involved using T1087.001 – Account Discovery to catalog active users, further enabling lateral movement to higher-privileged accounts, which aligned perfectly with their objectives of maximizing the impact and ransom potential.

Impact & Objectives

The ultimate impact of this ransomware attack was twofold: data encryption and extortion. Once the ransomware executed successfully, it began encrypting files, targeting critical assets within the organization while appending the file extensions with an arbitrary, identifiable string. In conjunction, the actor exfiltrated sensitive data prior to file encryption, employing the tactic of data theft not only to leverage against the organization but also to ensure that even if the ransom was paid, the actor still retained the potential for further exploitation. This is an emerging trend we categorize under T1041 – Exfiltration Over Command and Control Channel.

MITRE ATT&CK Mapping

  • T1203 – Exploitation for Client Execution: Utilized a malicious Word document to execute the initial payload.
  • T1547.001 – Registry Run Keys / Startup Folder: Enabled persistence through registry modification.
  • T1071.001 – Application Layer Protocol: Web Protocols: Employed a web-based C2 architecture.
  • T1021.001 – Remote Services: Remote Desktop Protocol: Facilitated lateral movement across the network.
  • T1041 – Exfiltration Over Command and Control Channel: Exfiltrated sensitive data before encryption.

Detection Opportunities

  • Monitor for anomalous PowerShell execution, particularly concerning base64 encoded commands.
  • Establish alerts for new registry keys under HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.
  • Implement network traffic analysis to detect anomalous DNS queries or HTTP requests to known malicious domains.

Analyst Notes

This incident highlights the evolving sophistication of ransomware actors, specifically in how they employ multi-staged attacks orchestrated from initial access through to the impact phase. Organizations must prioritize user awareness training alongside continuous monitoring of network and endpoint behaviors to fortify against such attacks. With the rising trend of double extortion, it’s crucial for defenders to adopt a layered defense strategy that encompasses both prevention and detection.

Source: Original Report

Related Posts