Sarah Chen — Malware Reverse Engineer
Key Takeaways
- This campaign exploits phishing emails to deliver ransomware payloads.
- We identified the use of obfuscated PowerShell scripts for initial execution.
- The actor utilized C2 infrastructure that leverages encrypted communications for command and control.
Executive Summary
During our investigation of a recent ransomware campaign targeting financial institutions, we uncovered a sophisticated attack chain that begins with phishing emails designed to deceive recipients into downloading malicious attachments. The actor deployed a variant of the Ryuk ransomware, utilizing multiple obfuscation techniques and advanced TTPs to evade detection. Our analysis delves into the intricacies of the attack vector, execution methods, command-and-control infrastructure, lateral movement techniques, and the ultimate impact on affected organizations.
Initial Access
The initial access phase centered around well-crafted phishing emails that appeared to originate from legitimate sources. The emails contained attachments that were either Excel files with embedded macros or executable files disguised as documents. When the victim opened the attachment and enabled macros, a series of obfuscated PowerShell scripts were triggered. These scripts were responsible for downloading the ransomware payload from the actor’s remote server, thereby initiating the infection process.
Execution & Persistence
We observed that the ransomware employs sophisticated techniques for execution and persistence. The sample we examined dropped the executable to the C:\ProgramData\Windows\System\svchost.exe directory, making it less visible to users and system administrators. Additionally, the installer made modifications to the Windows Registry using the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure that the ransomware would start with each boot of the system, effectively ensuring persistence.
Command and Control
Our analysis revealed that the attack utilized a multi-stage command-and-control (C2) infrastructure leveraging both HTTP and HTTPS protocols. The ransomware beaconed to a series of domains, which were actively registered and configured to switch IP addresses to avoid detection. Communication with the C2 server was encrypted using SSL, complicating analysis. We identified domains such as control.example.com and update.example.com as part of the C2 framework, which provided the actor the ability to send commands and receive data from compromised machines.
Lateral Movement & Discovery
Once installed, the ransomware attempted lateral movement through network shares and exploited legitimate tools such as Windows Management Instrumentation (WMI) and Remote Desktop Protocol (RDP). In one instance, the actor executed Get-WmiObject -Class Win32_ComputerSystem to discover other systems on the network. Following discovery, the actor deployed the ransomware to secondary machines using the PsExec tool, which facilitated rapid spread across the compromised environment. The use of living-off-the-land (LotL) techniques not only minimized noise but also allowed evasion of standard security protocols.
Impact & Objectives
The primary objective of this campaign was financial gain through the encryption of critical organizational data, thereby demanding ransom payments in cryptocurrency to restore access. During our investigation, we noted significant disruption to operations at multiple financial institutions, with reports of data loss and operational downtime. The psychological impact was amplified by the threats made by the actor, who claimed to release sensitive data publicly if the ransom was not paid, thereby increasing pressure on victims to comply with demands.
MITRE ATT&CK Mapping
- T1566 – Phishing: The initial access occurred via phishing emails containing malicious attachments.
- T1059.001 – PowerShell: Use of PowerShell for script execution and downloading payloads.
- T1071.001 – Application Layer Protocol: Encrypted communication with command and control over HTTPS.
- T1075 – Pass the Hash: Technique used for lateral movement leveraging existing credentials.
Detection Opportunities
- Monitor incoming email for known malicious attachment types and phishing characteristics.
- Implement behavioral analysis to identify unusual PowerShell activity or suspicious command-line executions.
- Analyze traffic patterns for unexpected beaconing to suspicious domains over standard and encrypted protocols.
Analyst Notes
The attack underscores the ongoing threat posed by ransomware to the financial sector, emphasizing the necessity of robust phishing awareness training and comprehensive endpoint detection strategies. Our investigation highlighted the effectiveness of the actor’s use of established administrative tools for lateral movement, reinforcing the need for enhanced visibility and monitoring within environments. Organizations should take proactive measures to defend against similar techniques and continuously adapt their defense posture based on evolving threat landscapes.
Source: Original Report