Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/28/2020
05:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Lazarus Group Shifts Gears with Custom Ransomware

The North Korea-linked APT group has developed its own ransomware strain to better conduct financial theft, researchers report.

Lazarus Group, a prominent advanced persistent threat (APT) group linked to North Korea, is behind a little-known strain of ransomware used in attacks earlier this year. Its creation and distribution of VHD ransomware indicates a shift in strategy, report researchers who have been watching it.

VHD ransomware was leveraged in attacks against two organizations in March and April 2020, Kaspersky researchers report. The victims, one located in France and another in Asia, are both large companies in different industry verticals. This ransomware was the main factor tying them together, and analysts noticed a few traits that led them to the Lazarus Group attribution.

The malware itself "doesn't stand out of the ordinary," says Ivan Kwiatkowski, senior security researcher with Kaspersky. "During our first encounter with it, we felt like it was definitely recent and lacking in maturity."

In a description of this first attack, researchers say VHD is written in C++ and crawls connected disks to encrypt files and delete folders called System Volume Information, which are linked to Windows' restore point feature. The malware stops processes that could lock important files, such as Microsoft Exchange and SQL Server. The way operators implemented cryptography is "very unorthodox and not state-of-the-art," though it's not breakable, Kwiatkowski explains.

What reminded them of APT campaigns in this incident was use of a spreader utility hardcoding victim credentials. This propagated the ransomware inside the network and held administrative credentials and IP addresses specific to the victim. The utility used these credentials to brute-force the Server Message Block (SMB) service on every machine it found; when a connection was made, VHD was copied and executed via WMI calls.

"This is not a TTP [tactics, techniques, and procedures] we usually observe with cybercrime threat actors who will usually rely on pen testing techniques to go straight after the victim's Active Directory infrastructure and achieve total control over the network," Kwiatkowski adds. This technique reminded researchers of APT campaigns SonySPE, Shamoon, and OlympicDestroyer, all wipers with worming capabilities.

The attack didn't fit the pattern of traditional ransomware campaigns. Researchers found VHD was not widespread and only found a few samples in their telemetry and a few public references. This indicates it's not traded in market forums, which is usually how it's monetized.

Soon after, Kaspersky's Incident Response Team handled another attack involving VHD. They believe attackers exploited a vulnerable VPN gateway to gain access; from there, they obtained administrative privileges, deployed a backdoor, and took over the Active Directory server. This enabled them to deploy VHD to all machines in the network over the course of 10 hours.

This attack did not employ a spreading utility but instead deployed VHD through a downloader that is still believed to be in development. "In all likelihood, the attackers felt like that had controlled a big enough portion of the victim's network and that they didn't need to resort to such noisy methods to distribute the ransomware to all the victim machines," Kwiatkowski says.

The backdoor is an instance of a multiplatform framework dubbed MATA. As far as researchers know, Lazarus Group is the sole owner of MATA, leading to its attribution as the owner and operator of VHD ransomware. They do not believe VHD is in use among other criminal groups.

However, there have been other public mentions of VHD ransomware in specialized blogs, indicating there have been other attacks they're unaware of. Lazarus Group's role as the sole owner and distributor of VHD indicates it may be experimenting with new tactics.

A Shift in Strategy
Lazarus Group has always focused on financial gain but has traditionally been involved with banking and fraud targeting the SWIFT financial network, Kwiatkowski says. While the group's motivations haven't changed, he suspects news on targeted ransomware has reminded attackers how lucrative these attacks can be.

Its move to create and deploy custom ransomware is at odds with what researchers know about the ransomware ecosystem, which usually involves several independent groups with no links beside their business connections. The group behind an initial intrusion usually isn't the same group that compromised a victim's Active Directory server, which is not the group that wrote the ransomware code used in an attack, Kaspersky researchers say in a blog post.

In these attacks, Lazarus Group has also avoided common steps in ransomware attacks: Its attackers don't seem to be looking for backups, they're not looking at financial documents to set an appropriate ransom price, and they're not threatening to leak internal information.

While there is no clear reason why Lazarus Group is going solo, researchers predict it's trying to boost financial gain. It's obvious, they say, the group won't be able to match others' efficiency.

"We hypothesize that Lazarus is trying to handle all these roles by itself, because it is their perceived way of cutting middlemen and maximizing profits," Kwiatkowski says. "We'll look at future incidents closely, as it will indicate whether this strategy paid off for them."

Related Content:

 

 

Register now for this year's fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for details on conference information and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jbl0
50%
50%
jbl0,
User Rank: Apprentice
7/29/2020 | 1:16:01 PM
Re: Ransomware will continue to be effective....
To expand on your thought, I believe that the wider gap is business continuity.  Having data copies offline (out of reach of the encrypting mechanism) is a critical component of BC, but you have to have the plans, people, processes and technology to manage, implement and execute recovery before your business can continue.

Some questions that come to mind that might be useful to address for when the business is disrupted:
  • Prioritize: what is most critical to work on first? 
  • Cross-train: are staff prepared to work outside of their specialty to help overloaded teams?
  • Outsource: are third-parties identified who can spin up and spin down capacity on-demand?
  • Backup suppliers: what if primary suppliers are impacted, too?
  • Referral: could a competitor / alternate source meet urgent needs of customers?
  • Off-site plan: what if buildings and/or their controls are impacted?
  • Mobilize / diversify technologies: can we support BYOD or work-from-home?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/29/2020 | 10:17:08 AM
Ransomware will continue to be effective....
Ransomware will continue to be effective as long as businesses continue to not have a sufficient data backup program. Its unfortunate, but I don't see ransomware phasing out for quite some time.
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...
CVE-2021-21246
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/` endpoint there are no security checks enforced so it is possible to retrieve ar...