Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

11/2/2017
02:18 PM
Curtis Franklin
Curtis Franklin
Curt Franklin
50%
50%

New Ransomware Attack Targets Japan

ONI is the latest ransomware attack, but this time encrypted files are just the beginning.

What's worse than ransomware? Ransomware that hides a disk wiper. And the latest attack is actually worse than that.

Japanese companies have been hit by a ransomware attack that's being called "ONI," named for the file extension it gives to encrypted files. All the files in a particular sub-directory are encrypted into a single file. Then an HTML file is placed in the directory with instructions on how the ransom can be paid.

One of the interesting things about the attack is that there are actually two versions of the ONI encryptor. One performs as just described. The other, dubbed MBR-ONI, also encrypts the master boot record of the infected computer. This is a much more serious attack.

Why two versions?
The "standard" version of ONI operates on computers that did not contain critical information -- such as network active directory servers. MBR-ONI was saved for computers that did have those types of critical information on them. The difference in attacks and attacked computers leads to some interesting inferences about the attack itself.

First, in order for the attackers to decide which systems deserved which attack, they had to be on the computer snooping around for at least some period of time. Researchers have concluded that ONI was active for between 3 and 9 months on infected machines. During that time, the attackers were looking for credentials and other sensitive organizational information, and mapping network topologies.

Next, the attackers sent a group policy across the network to delete event logs and launch the ONI encryption routines. It is generally accepted that both of these actions were aimed at covering the electronic tracks of the attackers -- any money made from ransom payments is purely incidental.

A RAT in the network
ONI entered the organization through a spear-phishing campaign using
bogus Microsoft Office documents generally disguised as invoices. When opened, these used a VB script to place a Remote Access Trojan(RAT) on the infected system -- a RAT that would spread laterally through the organization using techniques similar to that in EternalBlue, an exploit developed by the NSA and released in the Vault7 disclosure on WikiLeaks.

The ONI attack makes use of at least two programs with legitimate purposes: the Ammyy Admin remote administration tool and DiskCryptor, which organizations use to legitimately encrypt files for security and privacy purposes.

There are three factors in the ONI attacks, which so far are only targeting organizations in Japan, that companies around the world might find disturbing. First, it seems likely that this is the latest in a string of ransomware attacks aimed at very specific nations or regions. This suggests that ransomware is increasingly being used as a weapon rather than a tool for criminal enterprise.

Second, ONI uses ransomware more as a tool for covering an attacker's tracks and true purposes rather than as a criminal act in and of itself. The problem here is that a group that wants to cover its tracks rather than make money has very little incentive to actually produce the keys to un-encrypt files. Any files affected could very easily be lost forever in such an attack.

Which brings us to the third concern. Backup and recovery routines are seen as a sovereign panacea for ransomware attacks. But if the attackers had months to be planting files in a system (as they did in these cases), then infections could easily extend back in time beyond a point at which backup files could be useful. There are limits to backups, and a long infectation can easily test or break those limits.

Lessons for computer professionals are largely those covered in previous attacks: Train users on anti-phishing protocols, have effective anti-malware technology and policies in place, utilize IDS/IPS technology, and (in spite of the last point, above) make sure that your backup and recovery routines are rock solid.

ONI, like Bad Rabbit and NotPetya before it, is a harbinger of things to come. Learn from the misfortune of others and be prepared for the next major ransomware attack.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Browsers to Enforce Shorter Certificate Life Spans: What Businesses Should Know
Kelly Sheridan, Staff Editor, Dark Reading,  7/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12441
PUBLISHED: 2020-08-06
Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The DoS can be triggered by sending a specially crafted network packet.
CVE-2020-13793
PUBLISHED: 2020-08-06
Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key.
CVE-2020-16207
PUBLISHED: 2020-08-06
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafted project files that may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the appli...
CVE-2020-16211
PUBLISHED: 2020-08-06
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially crafted project files, which may allow an attacker to read information.
CVE-2020-16213
PUBLISHED: 2020-08-06
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area, which may allow remote code execution, disclosure/modification of information, or ...