ransomhub
The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks. The announcement of the sale of the new Ransomware-as-a-Service (RaaS) by RansomHub was published on one of the Russian-origin forums used by cybercrime to advertise malicious services, known as RAMP4U (or RAMP). A user with the nickname and persona of 'koley' announced the affiliate program on February 2, 2024. In the new RaaS announcement, it was mentioned that the money laundering operation of the paid ransoms is the responsibility of the affiliate. This means that all communication and sending of the decryptor to the victim are done through chat. The split of this RaaS would be 90% of the value for the affiliate and 10% for the developer, who in this case would be the persona of Koley. Furthermore, according to the publication, the ransomware payload is written in Golang language, uses the asymmetric algorithm based on x25519, and encryption algorithms AES256, ChaCha20, and xChaCha20, standing out for its speed. The encryption is obfuscated using AST. The payload would support network propagation and encryption of data both in secure and local mode. According to Koley, the ransomware is designed to operate on platforms such as Windows, Linux, and ESXi, as well as other architectures such as ARM and MIPS. As pointed out by the panel and already highlighted by the intelligence team, Koley stated that the panel uses a .onion domain, allowing the affiliate to organize and manage targets and chat rooms, view access logs, automatically respond when offline, and create private blog pages. Source: https://github.com/crocodyli/ThreatActors-TTPs
- TA0001Initial Access
- TA0002Execution
- T1047Windows Management Instrumentation
The ransomware deletes shadow copies using the WMIC.exe utility.
- T1059Command and Scripting Interpreter
- T1059.001Command and Scripting Interpreter: PowerShell
- T1059.003Command and Scripting Interpreter: Windows Command Shell
The ransomware utilizes cmd.exe to execute various Windows utilities to implement various other techniques.
- T1059.006Command and Scripting Interpreter: Python
- T1203Exploitation for Client Execution
- TA0003Persistence
- T1098Account Manipulation
- T1133External Remote Services
- T1136Create Account
- T1136.001Create Account: Local Account
- T1136.002Create Account: Domain Account
- T1547Boot or Logon Autostart Execution
- T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1547.004Boot or Logon Autostart Execution: Winlogon Helper DLL
- TA0004Privilege Escalation
- TA0005Defense Evasion
- T1027Obfuscated Files or Information
- T1027.009Obfuscated Files or Information: Embedded Payloads
- T1027.013Obfuscated Files or Information: Encrypted/Encoded File
- T1036Masquerading
- T1055.012Process Injection: Process Hollowing
- T1070Indicator Removal
- T1070.001Indicator Removal: Clear Windows Event Logs
The ransomware clears the victim machine's application, system, and security event logs using the wevtutil.exe utility.
- T1112Modify Registry
- T1134Access Token Manipulation
- T1134.001Access Token Manipulation: Token Impersonation/Theft
- T1222.001File and Directory Permissions Modification: Windows Permissions
- T1480Execution Guardrails
- T1484.001Domain or Tenant Policy Modification: Group Policy Modification
- T1562Impair Defenses: Disable or Modify Tools
Threat actors use files such as: STONESTOP and POORTRY to load drivers for the purpose of disabling and deleting AV files.
- T1562.001Impair Defenses: Disable or Modify Tools
- T1564Hidden Artifacts
- T1564.003Hidden Artifacts: Hidden Window
- T1620Reflective DLL Injection
- TA0006Credential Access
- TA0007Discovery
- T1007System Service Discovery
- T1016.001Internet Connection Discovery
- T1018Remote System Discovery
- T1033System Owner/User Discovery
- T1046Network Service Discovery
- T1057Process Discovery
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1087Account Discovery
- T1087.001Account Discovery: Local Account
- T1087.002Account Discovery: Domain Account
- T1120Peripheral Device Discovery
- T1135Network Share Discovery
- T1482Domain Trust Discovery
- TA0008Lateral Movement
- T1021Remote Services
- T1021.001Remote Services: Remote Desktop Protocol
- T1021.002Remote Services: SMB/Windows Admin Shares
- T1021.004Remote Services: SSH
- T1210Exploitation of Remote Services
- T1570Lateral Tool Transfer
Affiliates were identified using: psexec.exe, PsExec.exe, and smbexec.exe for lateral movement.
- TA0009Collection
- T1005Data from Local System
- TA0010Exfiltration
- T1048Exfiltration Over Alternative Protocol
- T1048.002Exfiltration Over Alternative Protocol: Asymmetric Encrypted Non-C2 Protocol
- T1048.003Exfiltration Over Alternative Protocol: Unencrypted Non-C2 Protocol
- T1537Transfer Data to Cloud Account
- T1567Exfiltration Over Web Service
- T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage
- TA0011Command and Control
- TA0040Impact
- T1486Data Encrypted for Impact
Files are encrypted using file replacement method.
- T1489Service Stop
The Windows IIS service stop command is executed using iisreset.exe. Allows for encryption of web applications hosted on IIS servers as files linked to these applications are typically locked while IIS is running.
- T1490Inhibit System Recovery
The ransomware deletes system shadow copies to inhibit system recovery.
- T1529System Shutdown/Reboot
- T1531Account Access Removal
- T1561.001Disk Wipe: Disk Content Wipe
- TA0042Resource Development
- T1586Compromise Accounts