Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

05:50 PM
Connect Directly

Lazarus Group Shifts Gears with Custom Ransomware

The North Korea-linked APT group has developed its own ransomware strain to better conduct financial theft, researchers report.

Lazarus Group, a prominent advanced persistent threat (APT) group linked to North Korea, is behind a little-known strain of ransomware used in attacks earlier this year. Its creation and distribution of VHD ransomware indicates a shift in strategy, report researchers who have been watching it.

VHD ransomware was leveraged in attacks against two organizations in March and April 2020, Kaspersky researchers report. The victims, one located in France and another in Asia, are both large companies in different industry verticals. This ransomware was the main factor tying them together, and analysts noticed a few traits that led them to the Lazarus Group attribution.

The malware itself "doesn't stand out of the ordinary," says Ivan Kwiatkowski, senior security researcher with Kaspersky. "During our first encounter with it, we felt like it was definitely recent and lacking in maturity."

In a description of this first attack, researchers say VHD is written in C++ and crawls connected disks to encrypt files and delete folders called System Volume Information, which are linked to Windows' restore point feature. The malware stops processes that could lock important files, such as Microsoft Exchange and SQL Server. The way operators implemented cryptography is "very unorthodox and not state-of-the-art," though it's not breakable, Kwiatkowski explains.

What reminded them of APT campaigns in this incident was use of a spreader utility hardcoding victim credentials. This propagated the ransomware inside the network and held administrative credentials and IP addresses specific to the victim. The utility used these credentials to brute-force the Server Message Block (SMB) service on every machine it found; when a connection was made, VHD was copied and executed via WMI calls.

"This is not a TTP [tactics, techniques, and procedures] we usually observe with cybercrime threat actors who will usually rely on pen testing techniques to go straight after the victim's Active Directory infrastructure and achieve total control over the network," Kwiatkowski adds. This technique reminded researchers of APT campaigns SonySPE, Shamoon, and OlympicDestroyer, all wipers with worming capabilities.

The attack didn't fit the pattern of traditional ransomware campaigns. Researchers found VHD was not widespread and only found a few samples in their telemetry and a few public references. This indicates it's not traded in market forums, which is usually how it's monetized.

Soon after, Kaspersky's Incident Response Team handled another attack involving VHD. They believe attackers exploited a vulnerable VPN gateway to gain access; from there, they obtained administrative privileges, deployed a backdoor, and took over the Active Directory server. This enabled them to deploy VHD to all machines in the network over the course of 10 hours.

This attack did not employ a spreading utility but instead deployed VHD through a downloader that is still believed to be in development. "In all likelihood, the attackers felt like that had controlled a big enough portion of the victim's network and that they didn't need to resort to such noisy methods to distribute the ransomware to all the victim machines," Kwiatkowski says.

The backdoor is an instance of a multiplatform framework dubbed MATA. As far as researchers know, Lazarus Group is the sole owner of MATA, leading to its attribution as the owner and operator of VHD ransomware. They do not believe VHD is in use among other criminal groups.

However, there have been other public mentions of VHD ransomware in specialized blogs, indicating there have been other attacks they're unaware of. Lazarus Group's role as the sole owner and distributor of VHD indicates it may be experimenting with new tactics.

A Shift in Strategy
Lazarus Group has always focused on financial gain but has traditionally been involved with banking and fraud targeting the SWIFT financial network, Kwiatkowski says. While the group's motivations haven't changed, he suspects news on targeted ransomware has reminded attackers how lucrative these attacks can be.

Its move to create and deploy custom ransomware is at odds with what researchers know about the ransomware ecosystem, which usually involves several independent groups with no links beside their business connections. The group behind an initial intrusion usually isn't the same group that compromised a victim's Active Directory server, which is not the group that wrote the ransomware code used in an attack, Kaspersky researchers say in a blog post.

In these attacks, Lazarus Group has also avoided common steps in ransomware attacks: Its attackers don't seem to be looking for backups, they're not looking at financial documents to set an appropriate ransom price, and they're not threatening to leak internal information.

While there is no clear reason why Lazarus Group is going solo, researchers predict it's trying to boost financial gain. It's obvious, they say, the group won't be able to match others' efficiency.

"We hypothesize that Lazarus is trying to handle all these roles by itself, because it is their perceived way of cutting middlemen and maximizing profits," Kwiatkowski says. "We'll look at future incidents closely, as it will indicate whether this strategy paid off for them."

Related Content:



Register now for this year's fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for details on conference information and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
User Rank: Ninja
7/29/2020 | 10:17:08 AM
Ransomware will continue to be effective....
Ransomware will continue to be effective as long as businesses continue to not have a sufficient data backup program. Its unfortunate, but I don't see ransomware phasing out for quite some time.
User Rank: Apprentice
7/29/2020 | 1:16:01 PM
Re: Ransomware will continue to be effective....
To expand on your thought, I believe that the wider gap is business continuity.  Having data copies offline (out of reach of the encrypting mechanism) is a critical component of BC, but you have to have the plans, people, processes and technology to manage, implement and execute recovery before your business can continue.

Some questions that come to mind that might be useful to address for when the business is disrupted:
  • Prioritize: what is most critical to work on first? 
  • Cross-train: are staff prepared to work outside of their specialty to help overloaded teams?
  • Outsource: are third-parties identified who can spin up and spin down capacity on-demand?
  • Backup suppliers: what if primary suppliers are impacted, too?
  • Referral: could a competitor / alternate source meet urgent needs of customers?
  • Off-site plan: what if buildings and/or their controls are impacted?
  • Mobilize / diversify technologies: can we support BYOD or work-from-home?
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-14
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and, Dell Precision 7920 Rack Workstation BIOS contain a stack-based buffer overflow vulnerability in systems with Intel Optane DC Persistent Memory installed. A local malicious user with high privileges may potentially exploit t...
PUBLISHED: 2021-06-14
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a heap-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, a...
PUBLISHED: 2021-06-14
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a stack-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, ...
PUBLISHED: 2021-06-14
Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of service, arbitrary code execution, or information disclosure in System Ma...
PUBLISHED: 2021-06-14
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration...