Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


11:00 AM

Nation-State Attackers May Have Co-opted Vega Ransomware

The tactics used by the latest version of the Vega cryptolocker program indicates the code may have been stolen from its authors and is now being used for destructive attacks, a new report suggests.

Significant changes in the tactics of a new variant of the Vega ransomware may indicate that the code for the software is now in the hands of a nation-state actors, security firm BlackBerry Cylance stated on December 9.

The new ransomware variant, dubbed Zeppelin by BlackBerry Cylance, started spreading in early November and avoids infecting systems in Russia, Ukraine, Belorussia, and Kazakhstan, instead focusing on US and European technology and healthcare companies, according to the company's researchers. While the malware framework is modular and can easily be configured for different tasks, Zeppelin focuses on destructive attacks, says Josh Lemos, vice president of research and intelligence at BlackBerry Cylance. (Lemos is not related to this reporter.)

"Our speculation is that it is a state actor using the generalized codebase used in Buran, Vega, and prior campaigns, as a way to somewhat obfuscate their intentions, especially given that its targeting is so narrow," he says, adding: "We believe that they had access to source and have modified the code materially."

Ransomware continues to be a popular attack for cybercriminals. Where attackers once focused the malware on consumers, businesses are now the preferred targets of attack, because a single compromise can net tens of thousands of dollars for the attackers. In 2019, the overall number of ransomware attacks have declined, but attacks are increasingly targeted, according to an October report covering the first nine months of the year

Yet apart from North Korean attempts to generate cash from ransomware, most nation-state attackers have used the main ransoming tactic of encrypting data to prevent access as a way to disrupt the operations of rival nations' government agencies and companies. The change in the goals of the latest Vega variant suggest that a nation-state has gained access to the code, BlackBerry Cylance stated in its analysis.

"The major shift in targeting from Russian-speaking to Western countries, as well as differences in victim selection and malware deployment methods, suggest that this new variant of Vega ransomware ended up in the hands of different threat actors — either used by them as a service, or redeveloped from bought (or) stolen (or) leaked sources," according to the analysis. 

While the latest variant is more modular, the primary reason that the company's researchers attribute the latest malware to a nation-state is the change in targeting and the focus on destructive, rather than commercial, goals. The malware does leave a ransom demand behind but, unlike most malware, does not specify an amount or a bitcoin wallet to be paid.

"This seems intentionally there to disrupt or cause commercial harm to the targets, rather than yield a bunch of cash, and that is not really the M.O. of your run-of-the-mill cybercriminals," Lemos says. "Given this skill set and care that was taken in the campaign, my personal assessment is that they probably have the skill to go out and steal it from whoever they want to."

To date, the company has collected five samples of the hard-to-find malware. The attack likely affects "tens, not hundreds" of companies, he says.

Tactics-wise, the ransomware program does not break any new ground.

Zeppelin uses a basic method of obfuscating the various keys in the code that could be used to easily identify the software by security scanners that look for recognizable text. In addition, Zeppelin uses code of varying sizes and random APIs to evade detection, as well as delays in execution to foil sandbox analysis by outlasting the time that such analysis software spends waiting for signs of malicious execution. 

While BlackBerry Cylance did not attribute the ransomware to any specific nation, because the software avoids executing in Russia, Ukraine, Belorussia, and Kazakhstan by checking the machine's default language and IP address, the operators likely reside in one of those nations.

"In a stark opposition to the Vega campaign, all Zeppelin binaries — as well as some newer Buran samples — are designed to quit if running on machines that are based in Russia and some other ex-USSR countries," the company's analysis states.

Many questions still remain, Lemos acknowledges. Because the company has collected a handful of samples of the malware, the picture of the group's operations is less clear than BlackBerry Cylance researchers would like, he says.

"There is not a lot of information on the TTPs [tactics, techniques and procedures]," he says. "It is more about what is not there. With it being so modular and highly configurable, the fact that this was just used in this disruptive capacity could mean that it is just a cheap throwaway for them or that this is part of a larger campaign that we are not privy to."

Related Content

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "10 Security 'Chestnuts' We Should Roast Over the Open Fire."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Major Brazilian Bank Tests Homomorphic Encryption on Financial Data
Kelly Sheridan, Staff Editor, Dark Reading,  1/10/2020
Will This Be the Year of the Branded Cybercriminal?
Raveed Laeb, Product Manager at KELA,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Give us your best shot! You might win an Amazon gift card!
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-01-17
openQA before commit c172e8883d8f32fced5e02f9b6faaacc913df27b was vulnerable to XSS in the distri and version parameter. This was reported through the bug bounty program of Offensive Security
PUBLISHED: 2020-01-17
The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and...
PUBLISHED: 2020-01-17
The docker-kubic package in SUSE CaaS Platform 3.0 before 17.09.1_ce-7.6.1 provided access to an insecure API locally on the Kubernetes master node.
PUBLISHED: 2020-01-17
In SaltStack Salt through 2019.2.0, the salt-api NEST API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
PUBLISHED: 2020-01-17
Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI.