Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News

12/11/2019
11:00 AM
50%
50%

Nation-State Attackers May Have Co-opted Vega Ransomware

The tactics used by the latest version of the Vega cryptolocker program indicates the code may have been stolen from its authors and is now being used for destructive attacks, a new report suggests.

Significant changes in the tactics of a new variant of the Vega ransomware may indicate that the code for the software is now in the hands of a nation-state actors, security firm BlackBerry Cylance stated on December 9.

The new ransomware variant, dubbed Zeppelin by BlackBerry Cylance, started spreading in early November and avoids infecting systems in Russia, Ukraine, Belorussia, and Kazakhstan, instead focusing on US and European technology and healthcare companies, according to the company's researchers. While the malware framework is modular and can easily be configured for different tasks, Zeppelin focuses on destructive attacks, says Josh Lemos, vice president of research and intelligence at BlackBerry Cylance. (Lemos is not related to this reporter.)

"Our speculation is that it is a state actor using the generalized codebase used in Buran, Vega, and prior campaigns, as a way to somewhat obfuscate their intentions, especially given that its targeting is so narrow," he says, adding: "We believe that they had access to source and have modified the code materially."

Ransomware continues to be a popular attack for cybercriminals. Where attackers once focused the malware on consumers, businesses are now the preferred targets of attack, because a single compromise can net tens of thousands of dollars for the attackers. In 2019, the overall number of ransomware attacks have declined, but attacks are increasingly targeted, according to an October report covering the first nine months of the year

Yet apart from North Korean attempts to generate cash from ransomware, most nation-state attackers have used the main ransoming tactic of encrypting data to prevent access as a way to disrupt the operations of rival nations' government agencies and companies. The change in the goals of the latest Vega variant suggest that a nation-state has gained access to the code, BlackBerry Cylance stated in its analysis.

"The major shift in targeting from Russian-speaking to Western countries, as well as differences in victim selection and malware deployment methods, suggest that this new variant of Vega ransomware ended up in the hands of different threat actors — either used by them as a service, or redeveloped from bought (or) stolen (or) leaked sources," according to the analysis. 

While the latest variant is more modular, the primary reason that the company's researchers attribute the latest malware to a nation-state is the change in targeting and the focus on destructive, rather than commercial, goals. The malware does leave a ransom demand behind but, unlike most malware, does not specify an amount or a bitcoin wallet to be paid.

"This seems intentionally there to disrupt or cause commercial harm to the targets, rather than yield a bunch of cash, and that is not really the M.O. of your run-of-the-mill cybercriminals," Lemos says. "Given this skill set and care that was taken in the campaign, my personal assessment is that they probably have the skill to go out and steal it from whoever they want to."

To date, the company has collected five samples of the hard-to-find malware. The attack likely affects "tens, not hundreds" of companies, he says.

Tactics-wise, the ransomware program does not break any new ground.

Zeppelin uses a basic method of obfuscating the various keys in the code that could be used to easily identify the software by security scanners that look for recognizable text. In addition, Zeppelin uses code of varying sizes and random APIs to evade detection, as well as delays in execution to foil sandbox analysis by outlasting the time that such analysis software spends waiting for signs of malicious execution. 

While BlackBerry Cylance did not attribute the ransomware to any specific nation, because the software avoids executing in Russia, Ukraine, Belorussia, and Kazakhstan by checking the machine's default language and IP address, the operators likely reside in one of those nations.

"In a stark opposition to the Vega campaign, all Zeppelin binaries — as well as some newer Buran samples — are designed to quit if running on machines that are based in Russia and some other ex-USSR countries," the company's analysis states.

Many questions still remain, Lemos acknowledges. Because the company has collected a handful of samples of the malware, the picture of the group's operations is less clear than BlackBerry Cylance researchers would like, he says.

"There is not a lot of information on the TTPs [tactics, techniques and procedures]," he says. "It is more about what is not there. With it being so modular and highly configurable, the fact that this was just used in this disruptive capacity could mean that it is just a cheap throwaway for them or that this is part of a larger campaign that we are not privy to."

Related Content

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "10 Security 'Chestnuts' We Should Roast Over the Open Fire."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9008
PUBLISHED: 2020-02-25
Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.
CVE-2020-9018
PUBLISHED: 2020-02-25
LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.
CVE-2020-9019
PUBLISHED: 2020-02-25
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
CVE-2020-9391
PUBLISHED: 2020-02-25
An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID-dcde237319e6. This has been ...
CVE-2020-8793
PUBLISHED: 2020-02-25
OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.