Priya Nair — Digital Forensics Analyst
Key Takeaways
- The REvil ransomware employs advanced obfuscation techniques to evade detection and exfiltrate sensitive data.
- Initial access is often achieved through Phishing and exploiting known vulnerabilities, primarily targeting SMB services.
- Command and Control communications utilize encrypted channels, complicating analysis and response efforts.
Executive Summary
Our investigation into a recent REvil ransomware campaign has revealed a sophisticated attack chain marked by multiple tactics and techniques that align closely with the MITRE ATT&CK framework. This campaign is characterized by its methodical approach to achieving initial access, maintaining persistence, and executing lateral movement within compromised networks. During our analysis, we focused on indicators of compromise (IOCs) associated with this malware, including notable evasive behaviors and C2 patterns that we observed.
Initial Access
Initial access in this campaign frequently originated from successful phishing attacks targeting employees via malicious email attachments. In several documented incidents, we identified the use of fake invoices that contained Office macros. When enabled, these macros executed PowerShell commands that downloaded the initial dropper payload from an external server.
Additionally, we identified instances where vulnerabilities in Microsoft Exchange Server were exploited (specifically CVE-2021-26855) to gain footholds in corporate networks. This allowed the actor to escalate privileges and deploy their payloads with minimal resistance.
Execution & Persistence
Once the initial dropper was executed, it would typically deploy a secondary loader responsible for installing the main REvil ransomware payload. This loader often dropped files to specific directories such as C:\ProgramData\Temp\ and created scheduled tasks to ensure persistence across reboots.
Furthermore, our analysis revealed that the ransomware would modify the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key to ensure its continuous execution. Through these methods, the ransomware maintained persistent access, ready to execute upon the next system start.
Command and Control
We observed that the REvil sample employed various C2 communication techniques to facilitate data exfiltration and command reception. Initially, it used HTTP/S protocols to communicate with its C2 servers, which were often hosted on compromised Web servers. Notably, traffic was encrypted using SSL, which posed significant challenges in detecting malicious activities.
Our investigations uncovered several unique domain names and IP addresses associated with this campaign, and the actor often switched these over short time frames to evade detection leveraging domain generation algorithms (DGA). The C2 infrastructure allowed the ransomware to receive further instructions and update functionalities dynamically.
Lateral Movement & Discovery
Following successful deployment, the actor initiated lateral movement utilizing Windows Admin Shares (SMB) as well as Windows Remote Management (WinRM). During our examination, we identified the usage of tools such as Mimikatz to harvest credentials from memory, which facilitated the traversal to additional machines within the network.
Once lateral movement was established, the operator conducted reconnaissance activities using commands to enumerate active directory users and shared resources. This intelligence gathering phase was critical for mapping out the network and identifying high-value targets for ransomware deployment.
Impact & Objectives
The objectives of the REvil ransomware campaign are clear: to encrypt files and extort victims for payment. Upon successful execution, the ransomware encrypted files based on specified extensions, targeting business-critical documents, backups, and configuration files. We also noted that the actors left compromised notes demanding exorbitant ransoms, often in cryptocurrencies to anonymize transactions.
Our analysis indicates that beyond mere file encryption, the REvil actors exfiltrated sensitive data before triggering the ransomware. This dual strategy of encrypting and stealing data, known as double extortion, poses significant risks to organizations, as the threatened release of stolen data could lead to reputational damage and regulatory repercussions.
MITRE ATT&CK Mapping
- T1566 – Phishing: Utilization of phishing emails with malicious attachments to gain initial access.
- T1193 – Spear Phishing Attachment: Specific focus on delivering malicious macros through social engineering.
- T1071.001 – Application Layer Protocol: Web Protocols: Use of HTTP/S for Command and Control communications.
Detection Opportunities
- Implement network monitoring to detect unusual outbound connections to know C2 domains or IP addresses.
- Leverage EDR solutions to identify and block execution of known malicious file paths and behaviors such as modifications to registry keys for persistence.
- Deploy behavioral analysis tools that can flag abnormal usage of PowerShell and the execution of macros in
Office files.
Analyst Notes
Our ongoing investigations into the REvil ransomware show a clear evolution in their tactics, suggesting a need for organizations to continually adapt their defensive measures. Enhancing user awareness programs to prevent phishing and securing endpoints through robust configurations are essential steps. Continued intelligence sharing within the community highlights the importance of collaboration in combatting these advanced persistent threats.
Source: Original Report