Category Archives: Advisories

Advisories

North Korean State-Sponsored Threat Actors Deploying “MAUI” Ransomware

Read Time:2 Minute, 50 Second

Today, the United States Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Agency (CISA) and the Department of Treasury released a joint Cybersecurity Advisory on Maui Ransomware, which is attributed to state sponsored activity by the government of North Korea. The Joint CSA provides detailed insight on the various TTPs used by the threat actors behind Maui, which has targeted the Health and Public Health Sector.How Serious of an Issue is This?High. As ransomware activity causes downtime, theft of confidential and personally identifiable information (PII) and other significant impact to operations, it is important to ensure that various security measures are in place, like being up to date with patching vulnerable machines/infrastructure. Also, ensuring employees are trained and up to date on various social engineering attempts and tactics used by threat actors will be a first line of defense against such attacks.What is Maui Ransomware?Maui ransomware is unique in a way that it requires manual execution to start the encryption routine. Maui also features a CLI (command line interface) that is used by the threat actor to target specific files to encrypt. Maui also has the ability to identify previously encrypted files due to customer headers containing the original path of the file.Who are HIDDEN COBRA/LAZARUS/APT38/BeagleBoyz?HIDDEN COBRA also known as Lazarus/APT38/BeagleBoyz has been atributed to the government of North Korea. Also, they have been linked to multiple high-profile, financially-motivated attacks in various parts of the world – some of which have caused massive infrastructure disruptions. Notable attacks include the 2014 attack on a major entertainment company and a 2016 Bangladeshi financial institution heist that almost netted nearly $1 Billion (USD) for the attackers. Had it not been for a misspelling in an instruction that caused a bank to flag and block thirty transactions, HIDDEN COBRA would have pulled off a heist unlike any other. Although HIDDEN COBRA failed in their attempt, they were still able to net around 81 million dollars in total.The most recent notable attack attributed to HIDDEN COBRA was the Wannacry Ransomware attack, which resulted in massive disruption and damage worldwide to numerous organizations, especially those in manufacturing. Various estimates of the impact were in the hundreds of millions of dollars, with some estimates claiming billions. Other verticals which this group has targeted include critical infrastructures, entertainment, finance, healthcare, and telecommunication sectors across multiple countries.Who are the BeagleBoyz?The BeagleBoyz group is a newly identified group that is a subset of activity by the threat actors known as HIDDEN COBRA/LAZARUS/APT 38 and has been observed committing financial crimes, specifically cryptocurrency related thefts. Further information about the BeagleBoyz can be found here.What Operating Systems are Affected?Windows based operating systems are affected.What is the Status of Coverage?Fortinet customers running the latest definitions are protected against Maui with the following (AV) signatures:W32/Ransom_Win32_MAUICRYPT.YACC5W32/Agent.C5C2!trW32/PossibleThreatAnything Else to Note?Victims of ransomware are cautioned against paying ransoms by such organizations as CISA, NCSC, the FBI, and HHS. Payment does not guarantee files will be recovered. It may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities which could potentially be illegal according to a U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) advisory.

Read More

Advisories

Alert (AA22-181A) #StopRansomware: MedusaLocker

Read Time:2 Minute, 48 Second

FortiGuard Labs is aware that a joint Cybersecurity Advisory (CSA) on MedusaLocker ransomware was released by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Department of the Treasury, and the Financial Crimes Enforcement Network (FinCEN). MedusaLocker infection typically occurs through Remote Desktop Protocol (RDP) compromise, propagates MedusaLocker throughout the network, and uses AES-256 encryption to encrypt files.Why is this Significant?This is significant as the joint Cybersecurity Advisory (CSA) is the latest #StopRansomware advisory released by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Department of the Treasury, and the Financial Crimes Enforcement Network (FinCEN), which provides observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware.What is MedusaLocker Ransomware?MedusaLocker is a ransomware that encrypts files in the compromised machines with the AES-256 encryption algorithm and demands victims to pay a ransom in order to recover the affected files. According to the advisory, MedusaLocker primarily takes advantage of an insecure RDP configuration as an initial infection vector, however email spam and malicious attachments are also used.The advisory also states that MedusaLocker ransomware uses multiple infection processes:Uses a batch file to execute PowerShell script, which propagates the ransomware throughout the network. Restarts the LanmanWorkstation service, which allows registry edits to take effect. Kills the processes belonging to well-known security, accounting, and forensic software. Restarts the machine in safe mode.Encrypts files in the compromised machines with the AES-256 encryption algorithmRuns every 60 seconds, encrypting all files except those critical to the functionality of the victim’s machine and those that have the designated encrypted file extension. Establishes persistence by copying an executable (svhost.exe or svhostt.exe) to the %APPDATA%Roaming directory and scheduling a task to run the ransomware every 15 minutes. Attempts to prevent standard recovery techniques by deleting local backups, disabling startup recovery options, and deleting shadow copies.Leaves a ransom note into every folder containing instruction on how to reach out to the attacker either via MedusaLocker’s Tor sites or emails.The following is a list of known file extensions that MedusaLocker adds to the encrypts files:.1btc.bec.cn.datalock.deadfilesgr.decrypme.encrypted.faratak.FartingGiraffeAttacks.fileslock.fileslocked.jpz.nz.key1.lock.lockdata7.lockfiles.lockfilesUS.marlock01.marlock02.marlock08.marlock11.marlock13.marlock25.marlock6.marlock011.matlock20.mylock.newware.NET1.NZ.perfection.Readinstruction.READINSTRUCTION.ReadInstructions.readinstructions.rs.skynet.stopflies.tyco.tyco.uslockhh.uslockhh.zoomzoomn.exent_lock20.networkmaze.VinDizelPux.EG.support.deadfiles.readtheinstructions.lr.divsouth.lockfilesCO.lockfilesKR.EMPg296LCKThe following is a list of known MedusaLocker’s ransom notes:! _HOW_RECOVERY_FILES _!. HTML!!!HOW_TO_DECRYPT!!!how_to_ recover_data.html HOW_TO_OPEN_FILES.htmlHOW_TO_RECOVER_DATA.htmlhow_to_recover_data.html.marlock01How_to_recovery.txtinstructions.html READINSTRUCTION.html readinstructions.html readme_to_recover_filesrecovery_instruction.htmlrecovery_instructions.html What is the Status of Coverage?FortiGuard Labs provides the following AV coverage against known samples of MedusaLocker ransomware:W32/MedusaLocker.0FEB!trW32/MedusaLocker.9106!tr.ransomW32/MedusaLocker.C!tr.ransomW32/Ransom_Win32_MEDUSALOCKER.SMTHW32/Ransom_Win32_MEDUSALOCKER.SMTH!trW32/Ransom_Win32_MEDUSALOCKER.SMTH!tr.ransomW32/DelShad.BMQ!tr.ransomW32/Filecoder.FV!trW32/Filecoder.NSF!tr.ransomW32/Filecoder.NYA!tr.ransomW32/Generic.AC.171!trW32/Generik.DGWKQJO!trW32/Kryptik.HFBI!trW32/PossibleThreatW32/Ransomware.GUN!trW32/Zudochka.VHO!tr.ransomW64/Filecoder.DF!tr.ransomPossibleThreat.FAIRiskware/DelShad

Read More