Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/28/2020
05:50 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Lazarus Group Shifts Gears with Custom Ransomware

The North Korea-linked APT group has developed its own ransomware strain to better conduct financial theft, researchers report.

Lazarus Group, a prominent advanced persistent threat (APT) group linked to North Korea, is behind a little-known strain of ransomware used in attacks earlier this year. Its creation and distribution of VHD ransomware indicates a shift in strategy, report researchers who have been watching it.

VHD ransomware was leveraged in attacks against two organizations in March and April 2020, Kaspersky researchers report. The victims, one located in France and another in Asia, are both large companies in different industry verticals. This ransomware was the main factor tying them together, and analysts noticed a few traits that led them to the Lazarus Group attribution.

The malware itself "doesn't stand out of the ordinary," says Ivan Kwiatkowski, senior security researcher with Kaspersky. "During our first encounter with it, we felt like it was definitely recent and lacking in maturity."

In a description of this first attack, researchers say VHD is written in C++ and crawls connected disks to encrypt files and delete folders called System Volume Information, which are linked to Windows' restore point feature. The malware stops processes that could lock important files, such as Microsoft Exchange and SQL Server. The way operators implemented cryptography is "very unorthodox and not state-of-the-art," though it's not breakable, Kwiatkowski explains.

What reminded them of APT campaigns in this incident was use of a spreader utility hardcoding victim credentials. This propagated the ransomware inside the network and held administrative credentials and IP addresses specific to the victim. The utility used these credentials to brute-force the Server Message Block (SMB) service on every machine it found; when a connection was made, VHD was copied and executed via WMI calls.

"This is not a TTP [tactics, techniques, and procedures] we usually observe with cybercrime threat actors who will usually rely on pen testing techniques to go straight after the victim's Active Directory infrastructure and achieve total control over the network," Kwiatkowski adds. This technique reminded researchers of APT campaigns SonySPE, Shamoon, and OlympicDestroyer, all wipers with worming capabilities.

The attack didn't fit the pattern of traditional ransomware campaigns. Researchers found VHD was not widespread and only found a few samples in their telemetry and a few public references. This indicates it's not traded in market forums, which is usually how it's monetized.

Soon after, Kaspersky's Incident Response Team handled another attack involving VHD. They believe attackers exploited a vulnerable VPN gateway to gain access; from there, they obtained administrative privileges, deployed a backdoor, and took over the Active Directory server. This enabled them to deploy VHD to all machines in the network over the course of 10 hours.

This attack did not employ a spreading utility but instead deployed VHD through a downloader that is still believed to be in development. "In all likelihood, the attackers felt like that had controlled a big enough portion of the victim's network and that they didn't need to resort to such noisy methods to distribute the ransomware to all the victim machines," Kwiatkowski says.

The backdoor is an instance of a multiplatform framework dubbed MATA. As far as researchers know, Lazarus Group is the sole owner of MATA, leading to its attribution as the owner and operator of VHD ransomware. They do not believe VHD is in use among other criminal groups.

However, there have been other public mentions of VHD ransomware in specialized blogs, indicating there have been other attacks they're unaware of. Lazarus Group's role as the sole owner and distributor of VHD indicates it may be experimenting with new tactics.

A Shift in Strategy
Lazarus Group has always focused on financial gain but has traditionally been involved with banking and fraud targeting the SWIFT financial network, Kwiatkowski says. While the group's motivations haven't changed, he suspects news on targeted ransomware has reminded attackers how lucrative these attacks can be.

Its move to create and deploy custom ransomware is at odds with what researchers know about the ransomware ecosystem, which usually involves several independent groups with no links beside their business connections. The group behind an initial intrusion usually isn't the same group that compromised a victim's Active Directory server, which is not the group that wrote the ransomware code used in an attack, Kaspersky researchers say in a blog post.

In these attacks, Lazarus Group has also avoided common steps in ransomware attacks: Its attackers don't seem to be looking for backups, they're not looking at financial documents to set an appropriate ransom price, and they're not threatening to leak internal information.

While there is no clear reason why Lazarus Group is going solo, researchers predict it's trying to boost financial gain. It's obvious, they say, the group won't be able to match others' efficiency.

"We hypothesize that Lazarus is trying to handle all these roles by itself, because it is their perceived way of cutting middlemen and maximizing profits," Kwiatkowski says. "We'll look at future incidents closely, as it will indicate whether this strategy paid off for them."

Related Content:

 

 

Register now for this year's fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for details on conference information and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jbl0
50%
50%
jbl0,
User Rank: Apprentice
7/29/2020 | 1:16:01 PM
Re: Ransomware will continue to be effective....
To expand on your thought, I believe that the wider gap is business continuity.  Having data copies offline (out of reach of the encrypting mechanism) is a critical component of BC, but you have to have the plans, people, processes and technology to manage, implement and execute recovery before your business can continue.

Some questions that come to mind that might be useful to address for when the business is disrupted:
  • Prioritize: what is most critical to work on first? 
  • Cross-train: are staff prepared to work outside of their specialty to help overloaded teams?
  • Outsource: are third-parties identified who can spin up and spin down capacity on-demand?
  • Backup suppliers: what if primary suppliers are impacted, too?
  • Referral: could a competitor / alternate source meet urgent needs of customers?
  • Off-site plan: what if buildings and/or their controls are impacted?
  • Mobilize / diversify technologies: can we support BYOD or work-from-home?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/29/2020 | 10:17:08 AM
Ransomware will continue to be effective....
Ransomware will continue to be effective as long as businesses continue to not have a sufficient data backup program. Its unfortunate, but I don't see ransomware phasing out for quite some time.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12777
PUBLISHED: 2020-08-10
A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.
CVE-2020-12778
PUBLISHED: 2020-08-10
Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.
CVE-2020-12779
PUBLISHED: 2020-08-10
Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.
CVE-2020-12780
PUBLISHED: 2020-08-10
A security misconfiguration exists in Combodo iTop, which can expose sensitive information.
CVE-2020-12781
PUBLISHED: 2020-08-10
Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.