Priya Nair — Digital Forensics Analyst
Key Takeaways
- REvil employs spear-phishing emails as a vector for initial payload delivery, often utilizing malicious document files.
- The malware exhibits sophisticated evasion capabilities, including the use of legitimate Windows utilities for lateral movement.
- Indicators of Compromise (IOCs) such as specific registry keys and file paths are paramount for detection and response efforts.
Executive Summary
In our latest investigation, we analyzed a sophisticated ransomware attack attributed to the REvil group. Our analysis revealed a comprehensive attack chain characterized by careful planning and execution, hinting at advanced threat actor capabilities. This case serves as a critical reminder of the evolving nature of ransomware threats, spotlighting various techniques employed to infiltrate networks, maintain persistence, and ultimately extract ransom payments. We detailed each phase of the attack to highlight crucial IOCs and detection strategies.
Initial Access
The preliminary phase of the attack centered on initial access, largely facilitated via spear-phishing emails. We observed that these emails contained malicious attachments, typically utilizing vulnerabilities in Microsoft Office documents. The actor employed a malicious macro to enable the download and execution of the REvil payload once the user enabled content. This step made use of the T1203 – Exploitation for Client Execution technique from the MITRE ATT&CK framework, confirming that user interaction was a pivotal element in executing the initial compromise.
Execution & Persistence
Upon executing the macro, the sample we examined established a connection with an external Command and Control (C2) server where it could fetch additional payloads and configuration files. During execution, we noted a specific file pattern of %TEMP%\ransomware.exe which housed the core functionality of the ransomware. Persistence was achieved through the use of the T1547 – Boot or Logon Autostart Execution technique; the actor created a registry entry at HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ransomware to ensure the malicious payload executed at startup.
Command and Control
Continuing our investigation, we identified the C2 communications leveraging a decentralized architecture, which made attribution more challenging. The malware communicated over HTTPS with a C2 server utilizing a domain generation algorithm (DGA). This allowed for regular updates and interactions without the need for static IP addresses, thus enhancing the actor’s operational security. We observed beacons at regular intervals, indicative of the T1071 – Application Layer Protocol for C2 communication which showcased the meticulous planning of the malware’s operational framework.
Lateral Movement & Discovery
Once inside the environment, the ransomware then leveraged several lateral movement techniques to propagate within the network. Among these, we noticed the utilization of PsExec and Windows Management Instrumentation (WMI), making it possible for the implant to execute commands on remote machines, while avoiding creating direct evidence of a breach. Active Directory credentials appeared compromised, directly indicative of T1075 – Pass the Ticket techniques, allowing the actor to navigate without raising alarms. This lateral movement increased the overall impact scope significantly, targeting critical servers across the file shares and cloud environments.
Impact & Objectives
The actor’s ultimate objective was ransom monetization through the encryption of files across the network. The payload was designed not only to encrypt user files but also to display a ransom note via a custom HTML page hosted on the victim’s local server. The ransom demand was set in cryptocurrency, typical for REvil operations, enhancing anonymity. We could ascertain that essential files were marked and encrypted, including backups, which indicated advanced planning to lock down recovery options. The total potential impact extended beyond immediate data loss, significantly disrupting business operations and causing reputational damage.
MITRE ATT&CK Mapping
- T1203 – Exploitation for Client Execution: malware leveraged vulnerabilities in Office documents.
- T1547 – Boot or Logon Autostart Execution: registry entry created for persistence.
- T1071 – Application Layer Protocol: C2 communication utilizing HTTPS.
- T1075 – Pass the Ticket: lateral movement through credential misuse.
Detection Opportunities
- Monitor for suspicious email attachments and macros within Microsoft Office applications.
- Implement alerting and blocking strategies for unusual registry changes, specifically under
HKCU\Software\Microsoft\Windows\CurrentVersion\Run. - Use detection tools to identify patterns in network traffic consistent with DGA and check for known C2 domains linked to REvil.
Analyst Notes
This incident underscores the importance of user education around phishing attempts and the necessity of having updated backups unaffected by ransomware. As organizations continue to face the threat of advanced ransomware attacks, investing in EDR solutions that monitor for abnormal behavior can greatly enhance detection and response capabilities. Additionally, comprehensive incident response plans that prepare organizations for these scenarios play a critical role in minimizing the financial impact of such attacks.
Source: Original Report