Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News

12/11/2019
11:00 AM
50%
50%

Nation-State Attackers May Have Co-opted Vega Ransomware

The tactics used by the latest version of the Vega cryptolocker program indicates the code may have been stolen from its authors and is now being used for destructive attacks, a new report suggests.

Significant changes in the tactics of a new variant of the Vega ransomware may indicate that the code for the software is now in the hands of a nation-state actors, security firm BlackBerry Cylance stated on December 9.

The new ransomware variant, dubbed Zeppelin by BlackBerry Cylance, started spreading in early November and avoids infecting systems in Russia, Ukraine, Belorussia, and Kazakhstan, instead focusing on US and European technology and healthcare companies, according to the company's researchers. While the malware framework is modular and can easily be configured for different tasks, Zeppelin focuses on destructive attacks, says Josh Lemos, vice president of research and intelligence at BlackBerry Cylance. (Lemos is not related to this reporter.)

"Our speculation is that it is a state actor using the generalized codebase used in Buran, Vega, and prior campaigns, as a way to somewhat obfuscate their intentions, especially given that its targeting is so narrow," he says, adding: "We believe that they had access to source and have modified the code materially."

Ransomware continues to be a popular attack for cybercriminals. Where attackers once focused the malware on consumers, businesses are now the preferred targets of attack, because a single compromise can net tens of thousands of dollars for the attackers. In 2019, the overall number of ransomware attacks have declined, but attacks are increasingly targeted, according to an October report covering the first nine months of the year

Yet apart from North Korean attempts to generate cash from ransomware, most nation-state attackers have used the main ransoming tactic of encrypting data to prevent access as a way to disrupt the operations of rival nations' government agencies and companies. The change in the goals of the latest Vega variant suggest that a nation-state has gained access to the code, BlackBerry Cylance stated in its analysis.

"The major shift in targeting from Russian-speaking to Western countries, as well as differences in victim selection and malware deployment methods, suggest that this new variant of Vega ransomware ended up in the hands of different threat actors — either used by them as a service, or redeveloped from bought (or) stolen (or) leaked sources," according to the analysis. 

While the latest variant is more modular, the primary reason that the company's researchers attribute the latest malware to a nation-state is the change in targeting and the focus on destructive, rather than commercial, goals. The malware does leave a ransom demand behind but, unlike most malware, does not specify an amount or a bitcoin wallet to be paid.

"This seems intentionally there to disrupt or cause commercial harm to the targets, rather than yield a bunch of cash, and that is not really the M.O. of your run-of-the-mill cybercriminals," Lemos says. "Given this skill set and care that was taken in the campaign, my personal assessment is that they probably have the skill to go out and steal it from whoever they want to."

To date, the company has collected five samples of the hard-to-find malware. The attack likely affects "tens, not hundreds" of companies, he says.

Tactics-wise, the ransomware program does not break any new ground.

Zeppelin uses a basic method of obfuscating the various keys in the code that could be used to easily identify the software by security scanners that look for recognizable text. In addition, Zeppelin uses code of varying sizes and random APIs to evade detection, as well as delays in execution to foil sandbox analysis by outlasting the time that such analysis software spends waiting for signs of malicious execution. 

While BlackBerry Cylance did not attribute the ransomware to any specific nation, because the software avoids executing in Russia, Ukraine, Belorussia, and Kazakhstan by checking the machine's default language and IP address, the operators likely reside in one of those nations.

"In a stark opposition to the Vega campaign, all Zeppelin binaries — as well as some newer Buran samples — are designed to quit if running on machines that are based in Russia and some other ex-USSR countries," the company's analysis states.

Many questions still remain, Lemos acknowledges. Because the company has collected a handful of samples of the malware, the picture of the group's operations is less clear than BlackBerry Cylance researchers would like, he says.

"There is not a lot of information on the TTPs [tactics, techniques and procedures]," he says. "It is more about what is not there. With it being so modular and highly configurable, the fact that this was just used in this disruptive capacity could mean that it is just a cheap throwaway for them or that this is part of a larger campaign that we are not privy to."

Related Content

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "10 Security 'Chestnuts' We Should Roast Over the Open Fire."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27132
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVE-2021-25284
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
CVE-2021-3144
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVE-2021-3148
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
CVE-2021-3151
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...