#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities

/in


Note: This Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and various ransomware threat actors. These #StopRansomware advisories detail historically and recently observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn about other ransomware threats and no-cost resources.

The United States National Security Agency (NSA), the U.S. Federal Bureau of Investigation (FBI), the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Department of Health and Human Services (HHS), the Republic of Korea (ROK) National Intelligence Service (NIS), and the ROK Defense Security Agency (DSA) (hereafter referred to as the “authoring agencies”) are issuing this joint Cybersecurity Advisory (CSA) to highlight ongoing ransomware activity against Healthcare and Public Health Sector organizations and other critical infrastructure sector entities.

This CSA provides an overview of Democratic People’s Republic of Korea (DPRK) state-sponsored ransomware and updates the July 6, 2022, joint CSA North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector. This advisory highlights TTPs and IOCs DPRK cyber actors used to gain access to and conduct ransomware attacks against Healthcare and Public Health (HPH) Sector organizations and other critical infrastructure sector entities, as well as DPRK cyber actors’ use of cryptocurrency to demand ransoms.

The authoring agencies assess that an unspecified amount of revenue from these cryptocurrency operations supports DPRK national-level priorities and objectives, including cyber operations targeting the United States and South Korea governments—specific targets include Department of Defense Information Networks and Defense Industrial Base member networks. The IOCs in this product should be useful to sectors previously targeted by DPRK cyber operations (e.g., U.S. government, Department of Defense, and Defense Industrial Base). The authoring agencies highly discourage paying ransoms as doing so does not guarantee files and records will be recovered and may pose sanctions risks.

For additional information on state-sponsored DPRK malicious cyber activity, see CISA’s North Korea Cyber Threat Overview and Advisories webpage.

Download the PDF version of this report: pdf, 661 kb.

Note: This advisory uses the MITRE ATT&CK for Enterprise framework, version 12. See MITRE ATT&CK for Enterprise for all referenced tactics and techniques.

This CSA is supplementary to previous reports on malicious cyber actor activities involving DPRK ransomware campaigns—namely Maui and H0lyGh0st ransomware. The authoring agencies are issuing this advisory to highlight additional observed TTPs DPRK cyber actors are using to conduct ransomware attacks targeting South Korean and U.S. healthcare systems.

Observable TTPs

The TTPs associated with DPRK ransomware attacks include those traditionally observed in ransomware operations. Additionally, these TTPs span phases from acquiring and purchasing infrastructure to concealing DPRK affiliation:

  • Acquire Infrastructure [T1583]. DPRK actors generate domains, personas, and accounts; and identify cryptocurrency services to conduct their ransomware operations. Actors procure infrastructure, IP addresses, and domains with cryptocurrency generated through illicit cybercrime, such as ransomware and cryptocurrency theft.
  • Obfuscate Identity. DPRK actors purposely obfuscate their involvement by operating with or under third-party foreign affiliate identities and use third-party foreign intermediaries to receive ransom payments.
  • Purchase VPNs and VPSs [T1583.003]. DPRK cyber actors will also use virtual private networks (VPNs) and virtual private servers (VPSs) or third-country IP addresses to appear to be from innocuous locations instead of from DPRK.
  • Gain Access [TA0001]. Actors use various exploits of common vulnerabilities and exposures (CVE) to gain access and escalate privileges on networks. Recently observed CVEs that actors used to gain access include remote code execution in the Apache Log4j software library (known as Log4Shell) and remote code execution in various SonicWall appliances [T1190 and T1133]. Observed CVEs used include:
    • CVE 2021-44228
    • CVE-2021-20038
    • CVE-2022-24990

Actors also likely spread malicious code through Trojanized files for “X-Popup,” an open source messenger commonly used by employees of small and medium hospitals in South Korea [T1195].

The actors spread malware by leveraging two domains: xpopup.pe[.]kr and xpopup.com. xpopup.pe[.]kr is registered to IP address 115.68.95[.]128 and xpopup[.]com is registered to IP address 119.205.197[.]111. Related file names and hashes are listed in table 1.

Table 1: Malicious file names and hashes spread by xpopup domains
File Name MD5 Hash
xpopup.rar 1f239db751ce9a374eb9f908c74a31c9
X-PopUp.exe 6fb13b1b4b42bac05a2ba629f04e3d03
X-PopUp.exe cf8ba073db7f4023af2b13dd75565f3d
xpopup.exe 4e71d52fc39f89204a734b19db1330d3
x-PopUp.exe 43d4994635f72852f719abb604c4a8a1
xpopup.exe 5ae71e8440bf33b46554ce7a7f3de666

 

  • Move Laterally and Discovery [TA0007, TA0008]. After initial access, DPRK cyber actors use staged payloads with customized malware to perform reconnaissance activities, upload and download additional files and executables, and execute shell commands [T1083, T1021]. The staged malware is also responsible for collecting victim information and sending it to the remote host controlled by the actors [TA0010].
  • Employ Various Ransomware Tools [TA0040]. Actors have used privately developed ransomware, such as Maui and H0lyGh0st [T1486]. Actors have also been observed using or possessing publically available tools for encryption, such as BitLocker, Deadbolt, ech0raix, GonnaCry, Hidden Tear, Jigsaw, LockBit 2.0, My Little Ransomware, NxRansomware, Ryuk, and YourRansom [T1486]. In some cases, DPRK actors have portrayed themselves as other ransomware groups, such as the REvil ransomware group. For IOCs associated with Maui and H0lyGh0st ransomware usage, please see Appendix B.
  • Demand Ransom in Cryptocurrency. DPRK cyber actors have been observed setting ransoms in bitcoin [T1486]. Actors are known to communicate with victims via Proton Mail email accounts. For private companies in the healthcare sector, actors may threaten to expose a company’s proprietary data to competitors if ransoms are not paid. Bitcoin wallet addresses possibly used by DPRK cyber actors include:
    • 1MTHBCrBKYEthfa16zo9kabt4f9jMJz8Rm
    • bc1q80vc4yjgg6umedkut3e9mhehxl4q4dcjjyzh59
    • 1J8spy62o7z2AjQxoUpiCGnBh5cRWKVWJC
    • 16ENLdHbnmDcEV8iqN4vuyZHa7sSdYRh76
    • bc1q3wzxvu8yhs8h7mlkmf7277wyklkah9k4sm9anu
    • bc1q8xyt4jxhw7mgqpwd6qfdjyxgvjeuz57jxrvgk9
    • 1NqihEqYaQaWiZkPVdSMiTbt7dTy1LMxgX
    • bc1qxrpevck3pq1yzrx2pq2rkvkvy0jnm56nzjv6pw
    • 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
    • 1KCwfCUgnSy3pzNX7U1i5NwFzRtth4bRBc
    • 16sYqXancDDiijcuruZecCkdBDwDf4vSEC
    • 1N6JphHFaYmYaokS5xH31Z67bvk4ykd9CP
    • LZ1VNJfn6mWjPzkCyoBvqWaBZYXAwn135
    • 1KmWW6LgdgykBBrSXrFu9kdoHz95Fe9kQF
    • 1FX4W9rrG4F3Uc7gJ18GCwGab8XuW8Ajy2
    • bc1qlqgu2l2kms5338zuc95kxavctzyy0v705tpvyc
    • bc1qy6su7vrh7ts5ng2628escmhr98msmzg62ez2sp
    • bc1q8t69gpxsezdcr8w6tfzp3jeptq4tcp2g9d0mwy
    • bc1q9h7yj79sqm4t536q0fdn7n4y2atsvvl22m28ep
    • bc1qj6y72rk039mqpgtcy7mwjd3eum6cx6027ndgmd
    • bc1qcp557vltuu3qc6pk3ld0ayagrxuf2thp3pjzpe
    • bc1ql8wsflrjf9zlusauynzjm83mupq6c9jz9vnqxg
    • bc1qx60ec3nfd5yhsyyxkzkpts54w970yxj84zrdck
    • bc1qunqnjdlvqkjuhtclfp8kzkjpvdz9qnk898xczp
    • bc1q6024d73h48fnhwswhwt3hqz2lzw6x99q0nulm4
    • bc1qwdvexlyvg3mqvqw7g6l09qup0qew80wjj9jh7x
    • bc1qavrtge4p7dmcrnvhlvuhaarx8rek76wxyk7dgg
    • bc1qagaayd57vr25dlqgk7f00nhz9qepqgnlnt4upu
    • bc1quvnaxnpqlzq3mdhfddh35j7e7ufxh3gpc56hca
    • bc1qu0pvfmtxawm8s99lcjvxapungtsmkvwyvak6cs
    • bc1qg3zlxxhhcvt6hkuhmqml8y9pas76cajcu9ltdl
    • bc1qn7a3g23nzpuytchyyteyhkcse84cnylznl3j32
    • bc1qhfmqstxp3yp9muvuz29wk77vjtdyrkff4nrxpu
    • bc1qnh8scrvuqvlzmzgw7eesyrmtes9c5m78duetf3
    • bc1q7qry3lsrphmnw3exs7tkwzpvzjcxs942aq8n0y
    • bc1qcmlcxfsy0zlqhh72jvvc4rh7hvwhx6scp27na0
    • bc1q498fn0gauj2kkjsg35mlwk2cnxhaqlj7hkh8xy
    • bc1qnz4udqkumjghnm2a3zt0w3ep8fwdcyv3krr3jq
    • bc1qk0saaw7p0wrwla6u7tfjlxrutlgrwnudzx9tyw
    • bc1qyue2pgjk09ps7qvfs559k8kee3jkcw4p4vdp57
    • bc1q6qfkt06xmrpclht3acmq00p7zyy0ejydu89zwv
    • bc1qmge6a7sp659exnx78zhm9zgrw88n6un0rl9trs
    • bc1qcywkd7zqlwmjy36c46dpf8cq6ts6wgkjx0u7cn

Note: These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the U.S. National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. For more information on the CPGs, including additional recommended baseline protections, see cisa.gov/cpg.

The authoring agencies urge HPH organizations to:

  • Limit access to data by authenticating and encrypting connections (e.g., using public key infrastructure certificates in virtual private network (VPN) and transport layer security (TLS) connections) with network services, Internet of Things (IoT) medical devices, and the electronic health record system [CPG 3.3].
  • Implement the principle of least privilege by using standard user accounts on internal systems instead of administrative accounts [CPG 1.5], which grant excessive system administration privileges.
  • Turn off weak or unnecessary network device management interfaces, such as Telnet, SSH, Winbox, and HTTP for wide area networks (WANs) and secure with strong passwords and encryption when enabled.
  • Protect stored data by masking the permanent account number (PAN) when displayed and rendering it unreadable when stored—through cryptography, for example.
  • Secure the collection, storage, and processing practices for personally identifiable information (PII)/protected health information (PHI), per regulations such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Implementing HIPAA security measures could prevent the introduction of malware to the system [CPG 3.4].
    • Secure PII/ PHI at collection points and encrypt the data at rest and in transit using technologies, such as TLS. Only store personal patient data on internal systems that are protected by firewalls, and ensure extensive backups are available.
    • Create and regularly review internal policies that regulate the collection, storage, access, and monitoring of PII/PHI.
  • Implement and enforce multi-layer network segmentation with the most critical communications and data resting on the most secure and reliable layer [CPG 8.1].
  • Use monitoring tools to observe whether IoT devices are behaving erratically due to a compromise [CPG 3.1].

In addition, the authoring agencies urge all organizations, including HPH Sector organizations, to apply the following recommendations to prepare for and mitigate ransomware incidents:

  • Maintain isolated backups of data, and regularly test backup and restoration [CPG 7.3]. These practices safeguard an organization’s continuity of operations or at least minimize potential downtime from a ransomware incident and protect against data losses.
    • Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure.
  • Create, maintain, and exercise a basic cyber incident response plan and associated communications plan that includes response procedures for a ransomware incident [CPG 7.1, 7.2].
  • Install updates for operating systems, software, and firmware as soon as they are released [CPG 5.1]. Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats. Regularly check for software updates and end-of-life notifications and prioritize patching known exploited vulnerabilities. Consider leveraging a centralized patch management system to automate and expedite the process.
  • If you use Remote Desktop Protocol (RDP), or other potentially risky services, secure and monitor them closely [CPG 5.4].
    • Limit access to resources over internal networks, especially by restricting RDP and using virtual desktop infrastructure. After assessing risks, if RDP is deemed operationally necessary, restrict the originating sources, and require phishing-resistant multifactor authentication (MFA) to mitigate credential theft and reuse [CPG 1.3]. If RDP must be available externally, use a VPN, virtual desktop infrastructure, or other means to authenticate and secure the connection before allowing RDP to connect to internal devices. Monitor remote access/RDP logs, enforce account lockouts after a specified number of attempts to block brute force campaigns, log RDP login attempts, and disable unused remote access/RDP ports [CPG 1.1, 3.1].
    • Ensure devices are properly configured and that security features are enabled. Disable ports and protocols not in use for a business purpose (e.g., RDP Transmission Control Protocol port 3389).
    • Restrict the Server Message Block (SMB) protocol within the network to only access necessary servers and remove or disable outdated versions of SMB (i.e., SMB version 1). Threat actors use SMB to propagate malware across organizations.
    • Review the security posture of third-party vendors and those interconnected with your organization. Ensure all connections between third-party vendors and outside software or hardware are monitored and reviewed for suspicious activity [CPG 5.6, 6.2].
    • Implement application control policies that only allow systems to execute known and permitted programs [CPG 2.1].
    • Open document readers in protected viewing modes to help prevent active content from running.
  • Implement a user training program and phishing exercises [CPG 4.3] to raise awareness among users about the risks of visiting websites, clicking on links, and opening attachments. Reinforce the appropriate user response to phishing and spearphishing emails.
  • Require phishing-resistant MFA for as many services as possible [CPG 1.3]—particularly for webmail, VPNs, accounts that access critical systems, and privileged accounts that manage backups.
  • Use strong passwords [CPG 1.4] and avoid reusing passwords for multiple accounts. See CISA Tip Choosing and Protecting Passwords and National Institute of Standards and Technology (NIST) Special Publication 800-63B: Digital Identity Guidelines for more information.
  • Require administrator credentials to install software [CPG 1.5].
  • Audit user accounts with administrative or elevated privileges [CPG 1.5] and configure access controls with least privilege in mind.
  • Install and regularly update antivirus and antimalware software on all hosts.
  • Only use secure networks. Consider installing and using a VPN.
  • Consider adding an email banner to messages coming from outside your organizations [CPG 8.3] indicating that they are higher risk messages.
  • Consider participating in CISA’s no-cost Automated Indicator Sharing (AIS) program to receive real-time exchange of machine-readable cyber threat indicators and defensive measures.

If a ransomware incident occurs at your organization:

  • Follow your organization’s ransomware response checklist.
  • Scan backups. If possible, scan backup data with an antivirus program to check that it is free of malware. This should be performed using an isolated, trusted system to avoid exposing backups to potential compromise.
  • U.S. organizations: Follow the notification requirements as outlined in your cyber incident response plan. Report incidents to appropriate authorities; in the U.S., this would include the FBI at a local FBI Field Office, CISA at cisa.gov/report, or the U.S. Secret Service (USSS) at a USSS Field Office.
  • South Korean organizations: Please report incidents to NIS, KISA (Korea Internet & Security Agency), and KNPA (Korean National Police Agency).
    • NIS (National Intelligence Service)
    • KISA (Korea Internet & Security Agency)
    • KNPA (Korean National Police Agency)
  • Apply incident response best practices found in the joint Cybersecurity Advisory, Technical Approaches to Uncovering and Remediating Malicious Activity, developed by CISA and the cybersecurity authorities of Australia, Canada, New Zealand, and the United Kingdom.

Resources

Stairwell provided a YARA rule to identify Maui ransomware, and a Proof of Concept public RSA key extractor at the following link:
https://www.stairwell.com/news/threat-research-report-maui-ransomware/

Request For Information

The FBI is seeking any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, bitcoin wallet information, the decryptor file, and/or benign samples of encrypted files. As stated above, the authoring agencies discourage paying ransoms. Payment does not guarantee files will be recovered and may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. However, the agencies understand that when victims are faced with an inability to function, all options are evaluated to protect shareholders, employees, and customers.

Regardless of whether you or your organization decide to pay a ransom, the authoring agencies urge you to promptly report ransomware incidents using the contact information above.

Acknowledgements

NSA, FBI, CISA, and HHS would like to thank ROK NIS and DSA for their contributions to this CSA.

Disclaimer of endorsement

The information and opinions contained in this document are provided “as is” and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

Trademark recognition

Microsoft Threat Intelligence Center is a registered trademark of Microsoft Corporation. Apache®, Sonicwall, and Apache Log4j are trademarks of Apache Software Foundation. TerraMaster Operating System is a registered trademark of Octagon Systems.

Purpose

This document was developed in furtherance of the authors’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

Appendix A: CVE Details

CVE-2021-44228     CVSS 3.0: 10 (Critical)
Vulnerability Description
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Recommended Mitigations
Apply patches provided by vendor and perform required system updates.
Detection Methods
See vendors’ Guidance For Preventing, Detecting, and Hunting for Exploitation of the Log4j 2 Vulnerability.
Vulnerable Technologies and Versions
There are numerous vulnerable technologies and versions associated with CVE-2021-44228. For a full list, please check https://nvd.nist.gov/vuln/detail/CVE-2021-44228.
See https://nvd.nist.gov/vuln/detail/CVE-2021-44228 for more information.

 

CVE-2021-20038     CVSS 3.0: 9.8 (Critical)
Vulnerability Description
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server’s mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a ‘nobody’ user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
Recommended Mitigations
Apply all appropriate vendor updates
Upgrade to:

  • SMA 100 Series – (SMA 200, 210, 400, 410, 500v (ESX, Hyper-V, KVM, AWS, Azure):
  • SonicWall SMA100 build versions 10.2.0.9-41sv or later
  • SonicWall SMA100 build versions 10.2.1.3-27sv or later

System administrators should refer to the SonicWall Security Advisories in the reference section to determine affected applications/systems and appropriate fix actions.

Support for 9.0.0 firmware ended on 10/31/2021. Customers still using that firmware are requested to upgrade to the latest 10.2.x versions.
Vulnerable Technologies and Versions
Sonicwall Sma 200 Firmware 10.2.0.8-37Sv
Sonicwall Sma 200 Firmware 10.2.1.1-19Sv
Sonicwall Sma 200 Firmware 10.2.1.2-24Sv
Sonicwall Sma 210 Firmware 10.2.0.8-37Sv
Sonicwall Sma 210 Firmware 10.2.1.1-19Sv
Sonicwall Sma 210 Firmware 10.2.1.2-24Sv
Sonicwall Sma 410 Firmware 10.2.0.8-37Sv
Sonicwall Sma 410 Firmware 10.2.1.1-19Sv
Sonicwall Sma 410 Firmware 10.2.1.2-24Sv
Sonicwall Sma 400 Firmware 10.2.0.8-37Sv
Sonicwall Sma 400 Firmware 10.2.1.1-19Sv
Sonicwall Sma 400 Firmware 10.2.1.2-24Sv
Sonicwall Sma 500V Firmware 10.2.0.8-37Sv
Sonicwall Sma 500V Firmware 10.2.1.1-19Sv
Sonicwall Sma 500V Firmware 10.2.1.2-24Sv
See https://nvd.nist.gov/vuln/detail/CVE-2021-20038 for more information.

 

CVE-2022-24990    CVSS 3.x: N/A
Vulnerability Description
The TerraMaster OS Unauthenticated Remote Command Execution via PHP Object Instantiation Vulnerability is characterized by scanning activity targeting a flaw in the script enabling a remote adversary to execute commands on the target endpoint. The vulnerability is created by improper input validation of the webNasIPS component in the api.php script and resides on the TNAS device appliances’ operating system where users manage storage, backup data, and configure applications. By exploiting the script flaw a remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system. This may result in complete compromise of the target system, including the exfiltration of information. TNAS devices can be chained to acquire unauthenticated remote code execution with highest privileges.
Recommended Mitigations
Install relevant vendor patches. This vulnerability was patched in TOS version 4.2.30
Vulnerable Technologies and Versions
TOS v 4.2.29
See https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/ and https://forum.terra-master.com/en/viewtopic.php?t=3030 for more information.

Appendix B: Indicators of Compromise (IOCs)

The IOC section includes hashes and IP addresses for the Maui and H0lyGh0st ransomware variants—as well as custom malware implants assumedly developed by DPRK cyber actors, such as remote access trojans (RATs), loaders, and other tools—that enable subsequent deployment of ransomware. For additional Maui IOCs, see joint CSA North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector.

Table 2 lists MD5 and SHA256 hashes associated with malware implants, RATs, and other tools used by DPRK cyber actors, including tools that drop Maui ransomware files.

Table 2: File names and hashes of malicious implants, RATs, and tools
MD5Hash SHA256Hash
079b4588eaa99a1e802adf5e0b26d8aa f67ee77d6129bd1bcd5d856c0fc5314169
b946d32b8abaa4e680bb98130b38e7
0e9e256d8173854a7bc26982b1dde783 —
12c15a477e1a96120c09a860c9d479b3 6263e421e397db821669420489d2d3084
f408671524fd4e1e23165a16dda2225
131fc4375971af391b459de33f81c253 —
17c46ed7b80c2e4dbea6d0e88ea0827c b9af4660da00c7fa975910d0a19fda0720
31c15fad1eef935a609842c51b7f7d
1875f6a68f70bee316c8a6eda9ebf8de 672ec8899b8ee513dbfc4590440a61023
846ddc2ca94c88ae637144305c497e7
1a74c8d8b74ca2411c1d3d22373a6769 ba8f9e7afe5f78494c111971c39a89111ef
9262bf23e8a764c6f65c818837a44
1f6d9f8fbdbbd4e6ed8cd73b9e95a928 4f089afa51fd0c1b2a39cc11cedb3a4a32
6111837a5408379384be6fe846e016
2d02f5499d35a8dffb4c8bc0b7fec5c2 830207029d83fd46a4a89cd623103ba23
21b866428aa04360376e6a390063570
2e18350194e59bc6a2a3f6d59da11bd8 655aa64860f1655081489cf85b77f72a49
de846a99dd122093db4018434b83ae
3bd22e0ac965ebb6a18bb71ba39e96dc 6b7f566889b80d1dba4f92d5e2fb2f5ef24
f57fcfd56bb594978dffe9edbb9eb
40f21743f9cb927b2c84ecdb7dfb14a6 5081f54761947bc9ce4aa2a259a0bd60b
4ec03d32605f8e3635c4d4edaf48894
4118d9adce7350c3eedeb056a3335346 5b7ecf7e9d0715f1122baf4ce745c5fcd76
9dee48150616753fec4d6da16e99e
43e756d80225bdf1200bc34eef5adca8 afb2d4d88f59e528f0e388705113ae54b7
b97db4f03a35ae43cc386a48f263a0
47791bf9e017e3001ddc68a7351ca2d6 863b707873f7d653911e46885e261380b
410bb3bf6b158daefb47562e93cb657
505262547f8879249794fc31eea41fc6 f32f6b229913d68daad937cc72a57aa452
91a9d623109ed48938815aa7b6005c
5130888a0ad3d64ad33c65de696d3fa2 c92c1f3e77a1876086ce530e87aa9c1f9c
bc5e93c5e755b29cad10a2f3991435
58ad3103295afcc22bde8d81e77c282f 18b75949e03f8dcad513426f1f9f3ca209d
779c24cd4e941d935633b1bec00cb
5be1e382cd9730fbe386b69bd8045ee7 5ad106e333de056eac78403b033b89c58
b4c4bdda12e2f774625d47ccfd3d3ae
5c6f9c83426c6d33ff2d4e72c039b747 a3b7e88d998078cfd8cdf37fa5454c45f6c
bd65f4595fb94b2e9c85fe767ad47
640e70b0230dc026eff922fb1e44c2ea 6319102bac226dfc117c3c9e620cd99c7e
afbf3874832f2ce085850aa042f19c
67f4dad1a94ed8a47283c2c0c05a7594 3fe624c33790b409421f4fa2bb8abfd701d
f2231a959493c33187ed34bec0ae7
70652edadedbacfd30d33a826853467d 196fb1b6eff4e7a049cea323459cfd6c0e3
900d8d69e1d80bffbaabd24c06eba
739812e2ae1327a94e441719b885bd19 6122c94cbfa11311bea7129ecd5aea6fae
6c51d23228f7378b5f6b2398728f67
76c3d2092737d964dfd627f1ced0af80 bffe910904efd1f69544daa9b72f2a70fb29
f73c51070bde4ea563de862ce4b1
802e7d6e80d7a60e17f9ffbd62fcbbeb 87bdb1de1dd6b0b75879d8b8aef80b562
ec4fad365d7abbc629bcfc1d386afa6
827103a6b6185191fd5618b7e82da292 —
830bc975a04ab0f62bfedf27f7aca673 —
85995257ac07ae5a6b4a86758a2283d7 —
85f6e3e3f0bdd0c1b3084fc86ee59d19 f1576627e8130e6d5fde0dbe3dffcc8bc9e
ef1203d15fcf09cd877ced1ccc72a
87a6bda486554ab16c82bdfb12452e8b 980bb08ef3e8afcb8c0c1a879ec11c41b2
9fd30ac65436495e69de79c555b2be
891db50188a90ddacfaf7567d2d0355d 0837dd54268c373069fc5c1628c6e3d75e
b99c3b3efc94c45b73e2cf9a6f3207
894de380a249e677be2acb8fbdfba2ef —
8b395cc6ecdec0900facf6e93ec48fbb —
92a6c017830cda80133bf97eb77d3292 d1aba3f95f11fc6e5fec7694d188919555b
7ff097500e811ff4a5319f8f230be
9b0e7c460a80f740d455a7521f0eada1 45d8ac1ac692d6bb0fe776620371fca02b
60cac8db23c4cc7ab5df262da42b78
9b9d4cb1f681f19417e541178d8c75d7 f5f6e538001803b0aa008422caf2c3c2a7
9b2eeee9ddc7feda710e4aba96fea4
a1f9e9f5061313325a275d448d4ddd59 dfdd72c9ce1212f9d9455e2bca5a327c88
d2d424ea5c086725897c83afc3d42d
a452a5f693036320b580d28ee55ae2a3 99b0056b7cc2e305d4ccb0ac0a8a270d3f
ceb21ef6fc2eb13521a930cea8bd9f
a6e1efd70a077be032f052bb75544358 3b9fe1713f638f85f20ea56fd09d20a96cd
6d288732b04b073248b56cdaef878
ad4eababfe125110299e5a24be84472e a557a0c67b5baa7cf64bd4d42103d3b285
2f67acf96b4c5f14992c1289b55eaa
b1c1d28dc7da1d58abab73fa98f60a83 38491f48d0cbaab7305b5ddca64ba41a2b
eb89d81d5fb920e67d0c7334c89131
b6f91a965b8404d1a276e43e61319931 —
bdece9758bf34fcad9cba1394519019b 9d6de05f9a3e62044ad9ae66111308ccb9
ed2ee46a3ea37d85afa92e314e7127
c3850f4cc12717c2b54753f8ca5d5e0e 99b448e91669b92c2cc3417a4d9711209
509274dab5d7582baacfab5028a818c
c50b839f2fc3ce5a385b9ae1c05def3a 458d258005f39d72ce47c111a7d17e8c52
fe5fc7dd98575771640d9009385456
cf236bf5b41d26967b1ce04ebbdb4041 60425a4d5ee04c8ae09bfe28ca33bf9e76
a43f69548b2704956d0875a0f25145
d0e203e8845bf282475a8f816340f2e8 f6375c5276d1178a2a0fe1a16c5668ce52
3e2f846c073bf75bb2558fdec06531
ddb1f970371fa32faae61fc5b8423d4b dda53eee2c5cb0abdbf5242f5e82f4de83
898b6a9dd8aa935c2be29bafc9a469
f2f787868a3064407d79173ac5fc0864 92adc5ea29491d9245876ba0b29573936
33c9998eb47b3ae1344c13a44cd59ae
fda3a19afa85912f6dc8452675245d6b 56925a1f7d853d814f80e98a1c4890b0a6
a84c83a8eded34c585c98b2df6ab19
— 0054147db54544d77a9efd9baf5ec96a80
b430e170d6e7c22fcf75261e9a3a71
— 151ab3e05a23e9ccd03a6c49830dabb9e
9281faf279c31ae40b13e6971dd2fb8
— 1c926fb3bd99f4a586ed476e4683163892
f3958581bf8c24235cd2a415513b7f
— 1f8dcfaebbcd7e71c2872e0ba2fc6db81d6
51cf654a21d33c78eae6662e62392
— f226086b5959eb96bd30dec0ffcbf0f0918
6cd11721507f416f1c39901addafb
— 23eff00dde0ee27dabad28c1f4ffb8b09e8
76f1e1a77c1e6fb735ab517d79b76
— 586f30907c3849c363145bfdcdabe3e2e4
688cbd5688ff968e984b201b474730
— 8ce219552e235dcaf1c694be122d6339e
d4ff8df70bf358cd165e6eb487ccfc5
— 90fb0cd574155fd8667d20f97ac464eca67
bdb6a8ee64184159362d45d79b6a4
— c2904dc8bbb569536c742fca0c51a766e8
36d0da8fac1c1abd99744e9b50164f
— ca932ccaa30955f2fffb1122234fb1524f7d
e3a8e0044de1ed4fe05cab8702a5
— f6827dc5af661fbb4bf64bc625c78283ef8
36c6985bb2bfb836bd0c8d5397332
— f78cabf7a0e7ed3ef2d1c976c1486281f56
a6503354b87219b466f2f7a0b65c4

 

Table 3 lists MD5 and SHA256 hashes are associated with Maui Ransomware files.

Table 3: File names and hashes of Maui ransomware files
MD5 Hash SHA256 Hash
4118d9adce7350c3eedeb056a3335346 5b7ecf7e9d0715f1122baf4ce745c5fcd76
9dee48150616753fec4d6da16e99e
9b0e7c460a80f740d455a7521f0eada1 45d8ac1ac692d6bb0fe776620371fca02b
60cac8db23c4cc7ab5df262da42b78
fda3a19afa85912f6dc8452675245d6b 56925a1f7d853d814f80e98a1c4890b0a6
a84c83a8eded34c585c98b2df6ab19
2d02f5499d35a8dffb4c8bc0b7fec5c2 830207029d83fd46a4a89cd623103ba232
1b866428aa04360376e6a390063570
c50b839f2fc3ce5a385b9ae1c05def3a 458d258005f39d72ce47c111a7d17e8c52
fe5fc7dd98575771640d9009385456
a452a5f693036320b580d28ee55ae2a3 99b0056b7cc2e305d4ccb0ac0a8a270d3f
ceb21ef6fc2eb13521a930cea8bd9f
a6e1efd70a077be032f052bb75544358 3b9fe1713f638f85f20ea56fd09d20a96cd6
d288732b04b073248b56cdaef878
802e7d6e80d7a60e17f9ffbd62fcbbeb 87bdb1de1dd6b0b75879d8b8aef80b562e
c4fad365d7abbc629bcfc1d386afa6
— 0054147db54544d77a9efd9baf5ec96a80b
430e170d6e7c22fcf75261e9a3a71

 

Table 4 lists MD5 and SHA256 hashes associated with H0lyGh0st Ransomware files.

Table 4: File names and hashes of H0lyGh0st ransomware files
SHA256 Hash
99fc54786a72f32fd44c7391c2171ca31e72ca52725c68e2dde94d04c286fccd*
F8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86*
Bea866b327a2dc2aa104b7ad7307008919c06620771ec3715a059e675d9f40af*
6e20b73a6057f8ff75c49e1b7aef08abfcfe4e418e2c1307791036f081335c2d
f4d10b08d7dacd8fe33a6b54a0416eecdaed92c69c933c4a5d3700b8f5100fad
541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219
2d978df8df0cf33830aba16c6322198e5889c67d49b40b1cb1eb236bd366826d
414ed95d14964477bebf86dced0306714c497cde14dede67b0c1425ce451d3d7
Df0c7bb88e3c67d849d78d13cee30671b39b300e0cda5550280350775d5762d8

 

MD5 Hash
a2c2099d503fcc29478205f5aef0283b
9c516e5b95a7e4169ecbd133ed4d205f
d6a7b5db62bf7815a10a17cdf7ddbd4b
c6949a99c60ef29d20ac8a9a3fb58ce5
4b20641c759ed563757cdd95c651ee53
25ee4001eb4e91f7ea0bc5d07f2a9744
29b6b54e10a96e6c40e1f0236b01b2e8
18126be163eb7df2194bb902c359ba8e
eaf6896b361121b2c315a35be837576d
e4ee611533a28648a350f2dab85bb72a
e268cb7ab778564e88d757db4152b9fa

* from Microsoft blog post on h0lygh0st

Source…

ESXiArgs Ransomware Virtual Machine Recovery Guidance

/in


The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory (CSA) in response to the ongoing ransomware campaign, known as “ESXiArgs.” Malicious actors may be exploiting known vulnerabilities in VMware ESXi servers that are likely running unpatched and out-of-service or out-of-date versions of VMware ESXi software to gain access and deploy ransomware. The ESXiArgs ransomware encrypts configuration files on ESXi servers, potentially rendering virtual machines (VMs) unusable. 

CISA has released an ESXiArgs recovery script at github.com/cisagov/ESXiArgs-Recover. Organizations that have fallen victim to ESXiArgs ransomware can use this script to attempt to recover their files. This CSA provides guidance on how to use the script.
ESXiArgs actors have compromised over 3,800 servers globally. CISA and FBI encourage all organizations managing VMware ESXi servers to: 

  • Update servers to the latest version of VMware ESXi software, 
  • Harden ESXi hypervisors by disabling the Service Location Protocol (SLP) service, and 
  • Ensure the ESXi hypervisor is not exposed to the public internet. 

If malicious actors have compromised your organization with ESXiArgs ransomware, CISA and FBI recommend following the script and guidance provided in this CSA to attempt to recover access to your files.  

Download the PDF version of this report: pdf, 712 kb.

Note: CISA and FBI will update this CSA as more information becomes available.

Open-source reporting indicates that malicious actors are exploiting known vulnerabilities in VMware ESXi software to gain access to servers and deploy ESXiArgs ransomware. The actors are likely targeting end-of-life ESXi servers or ESXi servers that do not have the available ESXi software patches applied.[1] 

ESXiArgs ransomware encrypts certain configuration files on ESXi servers, potentially rendering VMs unusable. Specifically, the ransomware encrypts configuration files associated with the VMs; it does not encrypt flat files. As a result, it is possible, in some cases, for victims to reconstruct the encrypted configuration files based on the unencrypted flat file. The recovery script documented below automates the process of recreating configuration files. The full list of file extensions encrypted by the malware is: vmdk, vmx, vmxf, vmsd, vmsn, vswp, vmss, nvram, vmem.

Recovery Guidance

CISA and FBI do not encourage paying the ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, CISA and FBI urge you to promptly report ransomware incidents to a local FBI Field Office, or to CISA at cisa.gov/report. 

CISA is providing these steps to enable organizations to attempt recovery of their VMs. CISA’s GitHub ESXiArgs recovery script, which also outlines these steps, is available at github.com/cisagov/ESXiArgs-Recover. CISA is aware that some organizations have reported success in recovering files without paying ransoms. CISA’s script is based on findings published by third-party researchers.[2] 

Any organization seeking to use CISA’s ESXiArgs recovery script should carefully review the script to determine if it is appropriate for their environment before deploying it. This script does not seek to delete the encrypted configuration files, but instead seeks to create new configuration files that enable access to the VMs. While CISA works to ensure that scripts like this one are safe and effective, this script is delivered without warranty, either implicit or explicit. Do not use this script without understanding how it may affect your system. CISA does not assume liability for damage caused by this script. Note: Organizations that run into problems with the script can create a GitHub issue at https://github.com/cisagov/ESXiArgs-Recover/issues; CISA will do our best to resolve concerns.

1. Quarantine or take affected hosts offline to ensure that repeat infection does not occur.

2. Download CISA’s recovery script and save it as /tmp/recover.sh.
For example, with wget: wget -O /tmp/recover.sh https://raw.githubusercontent.com/cisagov/ESXiArgs-Recover/main/recover.sh.

3. Give the script execute permissions: chmod +x /tmp/recover.sh

4. Navigate to the folder of a VM you would like to recover and run ls to view the files.

Note: You may browse these folders by running ls /vmfs/volumes/datastore1. For instance, if the folder is called example, run cd /vmfs/volumes/datastore1/example.

5. View files by running ls. Note the name of the VM (via naming convention: [name].vmdk).

6. Run the recovery script with /tmp/recover.sh [name], where [name] is the name of the VM determined previously. 

a. If the VM is a thin format, run /tmp/recover.sh [name] thin.

b. If successful, the recovery script will output that it has successfully run. If unsuccessful, it may not be possible for the recovery script to recover your VMs; consider engaging external incident response help.

7. If the script succeeded, re-register the VM.

a. If the ESXi web interface is inaccessible, remove the ransom note and restore access via the following steps. (Note: Taking the steps below moves the ransom note to the file ransom.html. Consider archiving this file for future incident review.)

  • Run cd /usr/lib/vmware/hostd/docroot/ui/ && mv index.html ransom.html && mv index1.html index.html.
  • Run cd /usr/lib/vmware/hostd/docroot && mv index.html ransom.html && rm index.html && mv index1.html index.html.
  • Reboot the ESXi server (e.g., with the reboot command). After a few minutes, you should be able to navigate to the web interface.

b.    In the ESXi web interface, navigate to the Virtual Machines page.

  • If the VM you restored already exists, right click on the VM and select Unregister (see figure 1).
"Figure 1: Unregistering the virtual machine."
Figure 1: Unregistering the virtual machine.
  • Select Create / Register VM (see figure 2).
  • Select Register an existing virtual machine (see figure 2).
"Figure 2: Registering the virtual machine, selecting machine to register."
Figure 2: Registering the virtual machine, selecting machine to register.
  • Click Select one or more virtual machines, a datastore or a directory to navigate to the folder of the VM you restored. Select the vmx file in the folder (see figure 3).
"Figure 3: Registering the virtual machine, finalizing registration."
Figure 3: Registering the virtual machine, finalizing registration.
  • Select Next and Finish. You should now be able to use the VM as normal.

8.    Update servers to the latest software version, disable the Service Location Protocol (SLP) service, and ensure the ESXi hypervisor is not configured to be exposed to the public internet before putting systems back online. 

Additional Incident Response

The above script only serves as a method to recover essential services. Although CISA and FBI have not seen any evidence that the actors have established persistence, we recommend organizations take the following additional incident response actions after applying the script:

  1. Review network logging to and from ESXi hosts and the guest VMs for unusual scanning activity.
  2. Review traffic from network segments occupied by the ESXi hosts and guests. Consider restricting non-essential traffic to and from these segments.

If you detect activity from the above, implement your incident response plan. CISA and FBI urge you to promptly report ransomware incidents to a local FBI Field Office, or to CISA at cisa.gov/report.

Organizations should also collect and review artifacts, such as running processes/services, unusual authentications, and recent network connections.

See the joint CSA from the cybersecurity authorities of Australia, Canada, New Zealand, the United Kingdom, and the United States on Technical Approaches to Uncovering and Remediating Malicious Activity for additional guidance on hunting or investigating a network, and for common mistakes in incident handling. CISA also encourages government network administrators to see CISA’s Federal Government Cybersecurity Incident and Vulnerability Response Playbooks. Although tailored to federal civilian branch agencies, these playbooks provide operational procedures for planning and conducting cybersecurity incident and vulnerability response activities and detail steps for both incident and vulnerability response.  

Additional resources for recovering .vmdk files can be found on a third-party researcher’s website.[2]

Note: These mitigations align with the cross-sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. For more information on the CPGs, including additional recommended baseline protections, see cisa.gov/cpg.

CISA and FBI recommend all organizations: 

  • Temporarily remove connectivity for the associated ESXi server(s).
    • Upgrade your ESXi servers to the latest version of VMware ESXi software [CPG 5.1]. ESXi releases are cumulative, and the latest builds are documented in VMware’s article, Build numbers and versions of VMware ESXi/ESX.
    • Harden ESXi hypervisors by disabling the Service Location Protocol (SLP) service, which ESXiArgs may leverage. For more information on executing workarounds, see VMware’s guidance How to Disable/Enable the SLP Service on VMware ESXi. 
    • Ensure your ESXi hypervisor is not configured to be exposed to the public internet.

In addition, CISA and FBI recommend organizations apply the following recommendations to prepare for, mitigate/prevent, and respond to ransomware incidents.

Preparing for Ransomware

  • Maintain offline backups of data, and regularly test backup and restoration [CPG 7.3]. These practices safeguard an organization’s continuity of operations or at least minimize potential downtime from a ransomware incident and protect against data losses.
  • Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure.
  • Create, maintain, and exercise a basic cyber incident response plan and associated communications plan that includes response procedures for a ransomware incident [CPG 7.1, 7.2].

 Mitigating and Preventing Ransomware

  • Restrict Server Message Block (SMB) Protocol within the network to only access servers that are necessary and remove or disable outdated versions of SMB (i.e., SMB version 1). Threat actors use SMB to propagate malware across organizations.
  • Require phishing-resistant MFA for as many services as possible [CPG 1.3]—particularly for webmail, VPNs, accounts that access critical systems, and privileged accounts that manage backups.
  • Review the security posture of third-party vendors and those interconnected with your organization. Ensure all connections between third-party vendors and outside software or hardware are monitored and reviewed for suspicious activity.
  • Implement allow-listing policies for applications and remote access that only allow systems to execute known and permitted programs.
  • Open document readers in protected viewing modes to help prevent active content from running.
  • Implement user training program and phishing exercises to raise awareness among users about the risks of visiting suspicious websites, clicking on suspicious links, and opening suspicious attachments. Reinforce the appropriate user response to phishing and spearphishing emails.
  • Use strong passwords [CPG 1.4] and avoid reusing passwords for multiple accounts. See CISA Tip Choosing and Protecting Passwords and the NIST’s Special Publication 800-63B: Digital Identity Guidelines for more information.
  • Require administrator credentials to install software [CPG 1.5].
  • Audit user accounts with administrative or elevated privileges and configure access controls with least privilege in mind [CPG 1.5].
  • Install and regularly update antivirus and antimalware software on all hosts.
  • Consider adding an email banner to messages coming from outside your organizations.
  • Disable hyperlinks in received emails.
  • Consider participating in CISA’s no-cost Automated Indicator Sharing (AIS) program to receive real-time exchange of machine-readable cyber threat indicators and defensive measures. 

Responding to Ransomware Incidents

If a ransomware incident occurs at your organization:

  • Follow your organization’s Ransomware Response Checklist (see Preparing for Ransomware section).
  • Scan backups. If possible, scan backup data with an antivirus program to check that it is free of malware. This should be performed using an isolated, trusted system to avoid exposing backups to potential compromise.
  • Follow the notification requirements as outlined in your cyber incident response plan.
  • Report incidents to CISA at cisa.gov/report, FBI at a local FBI Field Office, or the U.S. Secret Service (USSS) at a USSS Field Office.
  • Apply incident response best practices found in the joint Cybersecurity Advisory, Technical Approaches to Uncovering and Remediating Malicious Activity, developed by CISA and the cybersecurity authorities of Australia, Canada, New Zealand, and the United Kingdom.

Note: CISA and FBI strongly discourage paying ransoms as doing so does not guarantee files and records will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities.

Resources 

See Stopransomware.gov, a whole-of-government approach, for ransomware resources and alerts.

Acknowledgements

CISA and FBI would like to thank VMware for their contributions to this CSA.

Source…

Protecting Against Malicious Use of Remote Monitoring and Management Software

/in


The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) (hereafter referred to as the “authoring organizations”) are releasing this joint Cybersecurity Advisory (CSA) to warn network defenders about malicious use of legitimate remote monitoring and management (RMM) software. In October 2022, CISA identified a widespread cyber campaign involving the malicious use of legitimate RMM software. Specifically, cyber criminal actors sent phishing emails that led to the download of legitimate RMM software—ScreenConnect (now ConnectWise Control) and AnyDesk—which the actors used in a refund scam to steal money from victim bank accounts.

Although this campaign appears financially motivated, the authoring organizations assess it could lead to additional types of malicious activity. For example, the actors could sell victim account access to other cyber criminal or advanced persistent threat (APT) actors. This campaign highlights the threat of malicious cyber activity associated with legitimate RMM software: after gaining access to the target network via phishing or other techniques, malicious cyber actors—from cybercriminals to nation-state sponsored APTs—are known to use legitimate RMM software as a backdoor for persistence and/or command and control (C2).

Using portable executables of RMM software provides a way for actors to establish local user access without the need for administrative privilege and full software installation—effectively bypassing common software controls and risk management assumptions.

The authoring organizations strongly encourage network defenders to review the Indicators of Compromise (IOCs) and Mitigations sections in this CSA and apply the recommendations to protect against malicious use of legitimate RMM software.

Download the PDF version of this report: pdf, 608 kb.

For a downloadable copy of IOCs, see AA23-025.stix (STIX, 19 kb).

Overview

In October 2022, CISA used trusted third-party reporting, to conduct retrospective analysis of EINSTEIN—a federal civilian executive branch (FCEB)-wide intrusion detection system (IDS) operated and monitored by CISA—and identified suspected malicious activity on two FCEB networks:

  • In mid-June 2022, malicious actors sent a phishing email containing a phone number to an FCEB employee’s government email address. The employee called the number, which led them to visit the malicious domain, myhelpcare[.]online.
  • In mid-September 2022, there was bi-directional traffic between an FCEB network and myhelpcare[.]cc.

Based on further EINSTEIN analysis and incident response support, CISA identified related activity on many other FCEB networks. The authoring organizations assess this activity is part of a widespread, financially motivated phishing campaign and is related to malicious typosquatting activity reported by Silent Push in the blog post Silent Push uncovers a large trojan operation featuring Amazon, Microsoft, Geek Squad, McAfee, Norton, and Paypal domains.

Malicious Cyber Activity

The authoring organizations assess that since at least June 2022, cyber criminal actors have sent help desk-themed phishing emails to FCEB federal staff’s personal, and government email addresses. The emails either contain a link to a “first-stage” malicious domain or prompt the recipients to call the cybercriminals, who then try to convince the recipients to visit the first-stage malicious domain. See figure 1 for an example phishing email obtained from an FCEB network.

 

Help desk-themed phishing email example
Figure 1: Help desk–themed phishing email example

 

The recipient visiting the first-stage malicious domain triggers the download of an executable. The executable then connects to a “second-stage” malicious domain, from which it downloads additional RMM software.

CISA noted that the actors did not install downloaded RMM clients on the compromised host. Instead, the actors downloaded AnyDesk and ScreenConnect as self-contained, portable executables configured to connect to the actor’s RMM server.

Note: Portable executables launch within the user’s context without installation. Because portable executables do not require administrator privileges, they can allow execution of unapproved software even if a risk management control may be in place to audit or block the same software’s installation on the network. Threat actors can leverage a portable executable with local user rights to attack other vulnerable machines within the local intranet or establish long term persistent access as a local user service.

CISA has observed that multiple first-stage domain names follow naming patterns used for IT help/support themed social-engineering, e.g., hservice[.]live, gscare[.]live, nhelpcare[.]info, deskcareme[.]live, nhelpcare[.]cc). According to Silent Push, some of these malicious domains impersonate known brands such as, Norton, GeekSupport, Geek Squad, Amazon, Microsoft, McAfee, and PayPal.[1] CISA has also observed that the first-stage malicious domain linked in the initial phishing email periodically redirects to other sites for additional redirects and downloads of RMM software.

Use of Remote Monitoring and Management Tools

In this campaign, after downloading the RMM software, the actors used the software to initiate a refund scam. They first connected to the recipient’s system and enticed the recipient to log into their bank account while remaining connected to the system. The actors then used their access through the RMM software to modify the recipient’s bank account summary. The falsely modified bank account summary showed the recipient was mistakenly refunded an excess amount of money. The actors then instructed the recipient to “refund” this excess amount to the scam operator.
Although this specific activity appears to be financially motivated and targets individuals, the access could lead to additional malicious activity against the recipient’s organization—from both other cybercriminals and APT actors. Network defenders should be aware that:

  • Although the cybercriminal actors in this campaign used ScreenConnect and AnyDesk, threat actors can maliciously leverage any legitimate RMM software.
  • Because threat actors can download legitimate RMM software as self-contained, portable executables, they can bypass both administrative privilege requirements and software management control policies.
  • The use of RMM software generally does not trigger antivirus or antimalware defenses.
  • Malicious cyber actors are known to leverage legitimate RMM and remote desktop software as backdoors for persistence and for C2.[2],[3],[4],[5],[6],[7],[8]
  • RMM software allows cyber threat actors to avoid using custom malware.

Threat actors often target legitimate users of RMM software. Targets can include managed service providers (MSPs) and IT help desks, who regularly use legitimate RMM software for technical and security end-user support, network management, endpoint monitoring, and to interact remotely with hosts for IT-support functions. These threat actors can exploit trust relationships in MSP networks and gain access to a large number of the victim MSP’s customers. MSP compromises can introduce significant risk—such as ransomware and cyber espionage—to the MSP’s customers.

The authoring organizations strongly encourage network defenders to apply the recommendations in the Mitigations section of this CSA to protect against malicious use of legitimate RMM software.

INDICATORS OF COMPROMISE

See table 1 for IOCs associated with the campaign detailed in this CSA.

Table 1: Malicious Domains and IP addresses observed by CISA

Domain

Description

Date(s) Observed

win03[.]xyz

Suspected first-stage malware domain

June 1, 2022

July 19, 2022

myhelpcare[.]online

Suspected first-stage malware domain

June 14, 2022

 

win01[.]xyz

Suspected first-stage malware domain

August 3, 2022

August 18, 2022

myhelpcare[.]cc

Suspected first-stage malware domain

September 14, 2022

247secure[.]us

Second-stage malicious domain

October 19, 2022

November 10, 2022

 

Additional resources to detect possible exploitation or compromise:

The authoring organizations encourage network defenders to:

  • Implement best practices to block phishing emails. See CISA’s Phishing Infographic for more information.
  • Audit remote access tools on your network to identify currently used and/or authorized RMM software.
  • Review logs for execution of RMM software to detect abnormal use of programs running as a portable executable.
  • Use security software to detect instances of RMM software only being loaded in memory.
  • Implement application controls to manage and control execution of software, including allowlisting RMM programs.
  • Require authorized RMM solutions only be used from within your network over approved remote access solutions, such as virtual private networks (VPNs) or virtual desktop interfaces (VDIs).
  • Block both inbound and outbound connections on common RMM ports and protocols at the network perimeter. 
  • Implement a user training program and phishing exercises to raise awareness among users about the risks of visiting suspicious websites, clicking on suspicious links, and opening suspicious attachments. Reinforce the appropriate user response to phishing and spearphishing emails.

RESOURCES

  • See CISA Insights Mitigations and Hardening Guidance for MSPs and Small- and Mid-sized Businesses for guidance on hardening MSP and customer infrastructure.
  • U.S. Defense Industrial Base (DIB) Sector organizations may consider signing up for the NSA Cybersecurity Collaboration Center’s DIB Cybersecurity Service Offerings, including Protective Domain Name System (PDNS) services, vulnerability scanning, and threat intelligence collaboration for eligible organizations. For more information on how to enroll in these services, email [email protected].
  • CISA offers several Vulnerability Scanning to help organizations reduce their exposure to threats by taking a proactive approach to mitigating attack vectors. See cisa.gov/cyber-hygiene-services.
  • Consider participating in CISA’s Automated Indicator Sharing (AIS) to receive real-time exchange of machine-readable cyber threat indicators and defensive measures. AIS is offered at no cost to participants as part of CISA’s mission to work with our public and private sector partners to identify and help mitigate cyber threats through information sharing and provide technical assistance, upon request, that helps prevent, detect, and respond to incidents.

PURPOSE

This advisory was developed by CISA, NSA, and MS-ISAC in furtherance of their respective cybersecurity missions, including their responsibilities to develop and issue cybersecurity specifications and mitigations.

DISCLAIMER

The information in this report is being provided “as is” for informational purposes only. CISA, NSA, and MS-ISAC do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring.

Source…

#StopRansomware: Cuba Ransomware | CISA

/in


Summary

Actions to take today to mitigate cyber threats from ransomware:

• Prioritize remediating known exploited vulnerabilities.
• Train users to recognize and report phishing attempts.
• Enable and enforce phishing-resistant multifactor authentication.

Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint CSA to disseminate known Cuba ransomware IOCs and TTPs associated with Cuba ransomware actors identified through FBI investigations, third-party reporting, and open-source reporting. This advisory updates the December 2021 FBI Flash: Indicators of Compromise Associated with Cuba Ransomware.

Note: While this ransomware is known by industry as “Cuba ransomware,” there is no indication Cuba ransomware actors have any connection or affiliation with the Republic of Cuba. 

Since the release of the December 2021 FBI Flash, the number of U.S. entities compromised by Cuba ransomware has doubled, with ransoms demanded and paid on the increase.

This year, Cuba ransomware actors have added to their TTPs, and third-party and open-source reports have identified a possible link between Cuba ransomware actors, RomCom Remote Access Trojan (RAT) actors, and Industrial Spy ransomware actors.

FBI and CISA encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of Cuba ransomware and other ransomware operations.

Download the PDF version of this report: pdf, 652 kb.

Technical Details

Overview

Since the December 2021 release of FBI Flash: Indicators of Compromise Associated with Cuba Ransomware, FBI has observed Cuba ransomware actors continuing to target U.S. entities in the following five critical infrastructure sectors: Financial Services, Government Facilities, Healthcare and Public Health, Critical Manufacturing, and Information Technology. As of August 2022, FBI has identified that Cuba ransomware actors have:

  • Compromised over 100 entities worldwide.
  • Demanded over 145 million U.S. Dollars (USD) and received over 60 million USD in ransom payments.

Cuba Ransomware Actors’ Tactics, Techniques, and Procedures

As previously reported by FBI, Cuba ransomware actors have leveraged the following techniques to gain initial access into dozens of entities in multiple critical infrastructure sectors:

  • Known vulnerabilities in commercial software [T1190]
  • Phishing campaigns [T1566]
  • Compromised credentials [T1078]
  • Legitimate remote desktop protocol (RDP) tools [T1563.002] 

After gaining initial access, the actors distributed Cuba ransomware on compromised systems through Hancitor—a loader known for dropping or executing stealers, such as Remote Access Trojans (RATs) and other types of ransomware, onto victims’ networks.

Since spring 2022, Cuba ransomware actors have modified their TTPs and tools to interact with compromised networks and extort payments from victims.[1],[2]

Cuba ransomware actors have exploited known vulnerabilities and weaknesses and have used tools to elevate privileges on compromised systems. According to Palo Alto Networks Unit 42,[2] Cuba ransomware actors have:

  • Exploited CVE-2022-24521 in the Windows Common Log File System (CLFS) driver to steal system tokens and elevate privileges.
  • Used a PowerShell script to identify and target service accounts for their associated Active Directory Kerberos ticket. The actors then collected and cracked the Kerberos tickets offline via Kerberoasting [T1558.003].
  • Used a tool, called KerberCache, to extract cached Kerberos tickets from a host’s Local Security Authority Server Service (LSASS) memory [T1003.001].
  • Used a tool to exploit CVE-2020-1472 (also known as “ZeroLogon”) to gain Domain Administrative privileges [T1068]. This tool and its intrusion attempts have been reportedly related to Hancitor and Qbot. 

According to Palo Alto Networks Unit 42, Cuba ransomware actors use tools to evade detection while moving laterally through compromised environments before executing Cuba ransomware. Specifically, the actors, “leveraged a dropper that writes a kernel driver to the file system called ApcHelper.sys. This targets and terminates security products. The dropper was not signed, however, the kernel driver was signed using the certificate found in the LAPSUS NVIDIA leak.”  [T1562.001].[2]

In addition to deploying ransomware, the actors have used “double extortion” techniques, in which they exfiltrate victim data, and (1) demand a ransom payment to decrypt it and, (2) threaten to publicly release it if a ransom payment is not made.[2]

Cuba Ransomware Link to RomCom and Industrial Spy Marketplace

Since spring 2022, third-party and open-source reports have identified an apparent link between Cuba ransomware actors, RomCom RAT actors, and Industrial Spy ransomware actors: 

  • According to Palo Alto Networks Unit 42, Cuba ransomware actors began using RomCom malware, a custom RAT, for command and control (C2).[2]
  • Cuba ransomware actors may also be leveraging Industrial Spy ransomware. According to third-party reporting, suspected Cuba ransomware actors compromised a foreign healthcare company. The threat actors deployed Industrial Spy ransomware, which shares distinct similarities in configuration to Cuba ransomware. Before deploying the ransomware, the actors moved laterally using Impacket and deployed the RomCom RAT and Meterpreter Reverse Shell HTTP/HTTPS proxy via a C2 server [T1090].
  • Cuba ransomware actors initially used their leak site to sell stolen data; however, around May 2022, the actors began selling their data on Industrial Spy’s online market for selling stolen data.[2]

RomCom actors have targeted foreign military organizations, IT companies, food brokers and manufacturers.[3][4] The actors copied legitimate HTML code from public-facing webpages, modified the code, and then incorporated it in spoofed domains [T1584.001], which allowed the RomCom actors to:

  • Host counterfeit Trojanized applications for
    • SolarWinds Network Performance Monitor (NPM),
    • KeePass password manager,
    • o    PDF Reader Pro, (by PDF Technologies, Inc., not an Adobe Acrobat or Reader product), and
    • Advanced IP Scanner software;
  • Deploy the RomCom RAT as the final stage.

INDICATORS OF COMPROMISE

See tables 1 through 5 for Cuba ransomware IOCs that FBI obtained during threat response investigations as of late August 2022. In addition to these tables, see the publications in the References section below for aid in detecting possible exploitation or compromise.

Note: For IOCs as of early November 2021, see FBI Flash: Indicators of Compromise Associated with Cuba Ransomware.

Table 1: Cuba Ransomware Associated Files and Hashes, as of Late August 2022

File Name

File Path

File Hash

netping.dll

c:\windows\temp

SHA256: f1103e627311e73d5f29e877243e7ca203292f9419303c661aec57745eb4f26c

shar.bat

 

MD5: 4c32ef0836a0af7025e97c6253054bca

SHA256: a7c207b9b83648f69d6387780b1168e2f1eabd23ae6e162dd700ae8112f8b96c

Psexesvc.exe

 

SHA256: 141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b69944

1.bat

 

 

216155s.dll

 

 

23246s.bat

 

SHA256: 02a733920c7e69469164316e3e96850d55fca9f5f9d19a241fad906466ec8ae8

23246s.dll

 

SHA256: 0cf6399db55d40bc790a399c6bbded375f5a278dc57a143e4b21ea3f402f551f

23246st.dll

 

SHA256: f5db51115fa0c910262828d0943171d640b4748e51c9a140d06ea81ae6ea1710

259238e.exe

 

 

31-100.bat

 

 

3184.bat

 

 

3184.dll

 

 

45.dll

 

SHA256:

857f28b8fe31cf5db6d45d909547b151a66532951f26cda5f3320d2d4461b583

4ca736d.exe

 

 

62e2e37.exe

 

 

64.235.39.82

 

 

64s.dll

 

 

7z.sfx

 

 

7zCon.sfx

 

 

7-zip.chm

 

 

82.ps1

 

 

9479.bat

 

SHA256: 08eb4366fc0722696edb03981f00778701266a2e57c40cd2e9d765bf8b0a34d0

9479p.bat

 

SHA256: f8144fa96c036a8204c7bc285e295f9cd2d1deb0379e39ee8a8414531104dc4a

9479p.ps1

 

SHA256: 88d13669a994d2e04ec0a9940f07ab8aab8563eb845a9c13f2b0fec497df5b17

a.exe

 

 

MD5: 03c835b684b21ded9a4ab285e4f686a3

 

SHA1: eaced2fcfdcbf3dca4dd77333aaab055345f3ab4

 

SHA256: 0f385cc69a93abeaf84994e7887cb173e889d309a515b55b2205805bdfe468a3

 

SHA256: 0d5e3483299242bf504bd3780487f66f2ec4f48a7b38baa6c6bc8ba16e4fb605

 

SHA256: 7e00bfb622072f53733074795ab581cf6d1a8b4fc269a50919dda6350209913c

 

SHA256: af4523186fe4a5e2833bbbe14939d8c3bd352a47a2f77592d8adcb569621ce02

a220.bat

 

 

a220.dll

 

SHA256: 8a3d71c668574ad6e7406d3227ba5adc5a230dd3057edddc4d0ec5f8134d76c3

a82.exe

 

SHA256: 4306c5d152cdd86f3506f91633ef3ae7d8cf0dd25f3e37bec43423c4742f4c42

a91.exe

 

SHA256: 3d4502066a338e19df58aa4936c37427feecce9ab8d43abff4a7367643ae39ce

a99.exe

 

SHA256: f538b035c3de87f9f8294bec272c1182f90832a4e86db1e47cbb1ab26c9f3a0b

aa.exe

 

 

aa2.exe

 

 

aaa.stage.16549040.dns.alleivice.com

 

 

add2.exe

 

 

advapi32.dll

 

 

agent.13.ps1

 

 

agent.bat

 

SHA256: fd87ca28899823b37b2c239fbbd236c555bcab7768d67203f86d37ede19dd975

agent.dll

 

 

agent13.bat

 

 

agent13.ps1

 

SHA256: 1817cc163482eb21308adbd43fb6be57fcb5ff11fd74b344469190bb48d8163b

agent64.bin

 

SHA256: bff4dd37febd5465e0091d9ea68006be475c0191bd8c7a79a44fbf4b99544ef1

agsyst121.bat

 

 

agsyst121.dll

 

 

all.bat

 

SHA256: ecefd9bb8b3783a81ab934b44eb3d84df5e58f0289f089ef6760264352cf878a

all.dll

 

SHA256: db3b1f224aec1a7c58946d819d729d0903751d1867113aae5cca87e38c653cf4

anet.exe

 

SHA1: 241ce8af441db2d61f3eb7852f434642739a6cc3

 

SHA256: 74fbf3cc44dd070bd5cb87ca2eed03e1bbeec4fec644a25621052f0a73abbe84

 

SHA256: b160bd46b6efc6d79bfb76cf3eeacca2300050248969decba139e9e1cbeebf53

SHA256: f869e8fbd8aa1f037ad862cf6e8bbbf797ff49556fb100f2197be4ee196a89ae

App.exe

 

 

appnetwork.exe

 

 

AppVClient.man

 

 

aswSP_arPot2

 

 

aus.exe

 

SHA256: 0c2ffed470e954d2bf22807ba52c1ffd1ecce15779c0afdf15c292e3444cf674

SHA256: 310afba59ab8e1bda3ef750a64bf39133e15c89e8c7cf4ac65ee463b26b136ba

av.bat

 

SHA256: b5d202456ac2ce7d1285b9c0e2e5b7ddc03da1cbca51b5da98d9ad72e7f773b8

c2.ps1

 

  

c2.ps1

 

 

cdzehhlzcwvzcmcr.aspx

 

 

check.exe

 

 

checkk.exe

 

 

checkk.txt

 

SHA256: 1f842f84750048bb44843c277edeaa8469697e97c4dbf8dc571ec552266bec9f

client32.exe

 

  

comctl32 .dll

 

 

comp2.ps1

 

 

comps2.ps1

 

 

cqyrrxzhumiklndm.aspx

 

 

defendercontrol.exe

 

 

ff.exe

 

SHA256: 1b943afac4f476d523310b8e3afe7bca761b8cbaa9ea2b9f01237ca4652fc834

File __agsyst121.dll

 

  

File __aswArPot.sys

 

 

File __s9239.dll

 

 

File_agsyst121.dll

 

 

File_aswArPot.sys

 

 

File_s9239.dll

 

 

ga.exe

 

 

gdi32 .dll

 

 

geumspbgvvytqrih.aspx

 

 

IObit UNLOCKER.exe

 

 

kavsa32.exe

 

MD5: 236f5de8620a6255f9003d054f08574b

SHA1: 9b546bd99272cf4689194d698c830a2510194722

kavsyst32.exe

 

 

kernel32.dll

 

  

komar.bat

 

SHA256: B9AFE016DBDBA389000B01CE7645E7EEA1B0A50827CDED1CBAA48FBC715197BB

komar.dll

 

 

komar121.bat

 

  

komar121.dll

 

 

komar2.ps1

 

SHA256: 61971d3cbf88d6658e5209de443e212100afc8f033057d9a4e79000f6f0f7cc4

komar64.dll

 

SHA256: 8E64BACAF40110547B334EADCB0792BDC891D7AE298FBFFF1367125797B6036B

mfcappk32.exe

 

  

newpass.ps1

 

SHA256: c646199a9799b6158de419b1b7e36b46c7b7413d6c35bfffaeaa8700b2dcc427

npalll.exe

 

SHA256: bd270853db17f94c2b8e4bd9fa089756a147ed45cbc44d6c2b0c78f361978906

ole32.dll

 

  

oleaut32.dll

 

  

open.bat

 

SHA256: 2EB3EF8A7A2C498E87F3820510752043B20CBE35B0CBD9AF3F69E8B8FE482676

open.exe

 

 

pass.ps1

 

SHA256: 0afed8d1b7c36008de188c20d7f0e2283251a174261547aab7fb56e31d767666

pdfdecrypt.exe

 

 

powerview.ps1

 

  

prt3389.bat

 

SHA256: e0d89c88378dcb1b6c9ce2d2820f8d773613402998b8dcdb024858010dec72ed

ra.ps1

 

SHA256: 571f8db67d463ae80098edc7a1a0cad59153ce6592e42d370a45df46f18a4ad8

rg1.exe

 

  

Rg2.exe

 

 

rundll32

 

  

s64174.bat

 

SHA256: 10a5612044599128981cb41d71d7390c15e7a2a0c2848ad751c3da1cbec510a2

SHA256: 1807549af1c8fdc5b04c564f4026e41790c554f339514d326f8b55cb7b9b4f79

s64174.dll

 

 

s9239.bat

 

 

s9239.dll

 

  

shell32.dll

 

 

stel.exe

 

 

syskav64.exe

 

 

sysra64,exe

 

 

systav332.bat

 

SHA256: 01242b35b6def71e42cc985e97d618e2fabd616b16d23f7081d575364d09ca74

TC-9.22a.2019.3.exe

 

 

TeamViewer.exe

 

 

testDLL.dll

 

  

tug4rigd.dll

 

SHA256: 952b34f6370294c5a0bb122febfaa80612fef1f32eddd48a3d0556c4286b7474

UpdateNotificationPipeline.002.etl

 

 

user32.dll

 

 

v1.bat

 

 

v2.bat

 

  

v3.bat

 

 

veeamp.exe

 

SHA256: 9aa1f37517458d635eae4f9b43cb4770880ea0ee171e7e4ad155bbdee0cbe732

version.dll

 

 

vlhqbgvudfnirmzx.aspx

 

 

wininet.dll

 

 

wlog.exe

 

  

wpeqawzp.sys

 

 

y3lcx345.dll

 

 

zero.exe

 

SHA256: 3a8b7c1fe9bd9451c0a51e4122605efc98e7e4e13ed117139a13e4749e211ed0
 

 

 

 

 

 

 

Table 2: Cuba Ransomware Associated Email Addresses, as of Late August 2022

Email Provider

Email Addresses

Cuba-supp[.]com

[email protected][.]com

Encryption-support[.]com

[email protected][.]com

Mail.supports24[.]net

[email protected][.]net

 

Table 3: Cuba Ransomware Associated Jabber Address, as of Late August 2022

[email protected][.]im

 

Table 4: IP Addresses Associated with Cuba Ransomware, as of Late August 2022
Note: Some of these observed IP addresses are more than a year old. FBI and CISA recommend vetting or investigating these IP addresses prior to taking forward-looking action such as blocking.

193.23.244[.]244

144.172.83[.]13

216.45.55[.]30

94.103.9[.]79

149.255.35[.]131

217.79.43[.]148

192.137.101[.]46

154.35.175[.]225

222.252.53[.]33

92.222.172[.]39

159.203.70[.]39

23.227.198[.]246

92.222.172[.]172

171.25.193[.]9

31.184.192[.]44

10.13.102[.]1

185.153.199[.]169

37.120.247[.]39

10.13.102[.]58

192.137.100[.]96

37.44.253[.]21

10.133.78[.]41

192.137.100[.]98

38.108.119[.]121

10.14.100[.]20

192.137.101[.]205

45.164.21[.]13

103.114.163[.]197

193.34.167[.]17

45.32.229[.]66

103.27.203[.]197

194.109.206[.]212

45.86.162[.]34

104.217.8[.]100

195.54.160[.]149

45.91.83[.]176

107.189.10[.]143

199.58.81[.]140

64.52.169[.]174

108.170.31[.]115

204.13.164[.]118

64.235.39[.]82

128.31.0[.]34

209.76.253[.]84

79.141.169[.]220

128.31.0[.]39

212.192.241[.]230

84.17.52[.]135

131.188.40[.]189

213.32.39[.]43

86.59.21[.]38

141.98.87[.]124

216.45.55[.]3

 

 

Table 5: Cuba Bitcoin Wallets Receiving Payments, as of Late August 2022

bc1q4vr25xkth35qslenqwd7aw020w85qrvlrhv7hc

bc1q5uc0fdnz0ve5pg4nl4upa9ly586t6wmnghfe7x

bc1q6rsj3cn37dngypu5kad9gdw5ykhctpwhjvun3z

bc1q6zkemtyyrre2mkk23g93zyq98ygrygvx7z2q0t

bc1q9cj0n9k2m282x0nzj6lhqjvhkkd4h95sewek83

bc1qaselp9nhejc3safcq3vn5wautx6w33x0llk7dl

bc1qc48q628t93xwzljtvurpqhcvahvesadpwqtsza

bc1qgsuf5m9tgxuv4ylxcmx8eeqn3wmlmu7f49zkus

bc1qhpepeeh7hlz5jvrp50uhkz59lhakcfvme0w9qh

bc1qjep0vx2lap93455p7h29unruvr05cs242mrcah

bc1qr9l0gcl0nvmngap6ueyy5gqdwvm34kdmtevjyx

bc1qs3lv77udkap2enxv928x59yuact5df4t95rsqr

bc1qyd05q2m5qt3nwpd3gcqkyer0gspqx5p6evcf7h

bc1qzz7xweq8ee2j35tq6r5m687kctq9huskt50edv

bc1qvpk8ksl3my6kjezjss9p28cqj4dmpmmjx5yl3y

bc1qhtwfcysclc7pck2y3vmjtpzkaezhcm6perc99x

bc1qft3s53ur5uq5ru6sl3zyr247dpr55mnggwucd3

bc1qp7h9fszlqxjwyfhv0upparnsgx56x7v7wfx4x7

bc1q4vr25xkth35qslenqwd7aw020w85qrvlrhv7hc

bc1q5uc0fdnz0ve5pg4nl4upa9ly586t6wmnghfe7x

bc1q6rsj3cn37dngypu5kad9gdw5ykhctpwhjvun3z

bc1q6zkemtyyrre2mkk23g93zyq98ygrygvx7z2q0t

bc1q9cj0n9k2m282x0nzj6lhqjvhkkd4h95sewek83

bc1qaselp9nhejc3safcq3vn5wautx6w33x0llk7dl

bc1qc48q628t93xwzljtvurpqhcvahvesadpwqtsza

bc1qgsuf5m9tgxuv4ylxcmx8eeqn3wmlmu7f49zkus

bc1qhpepeeh7hlz5jvrp50uhkz59lhakcfvme0w9qh

bc1qjep0vx2lap93455p7h29unruvr05cs242mrcah

bc1qr9l0gcl0nvmngap6ueyy5gqdwvm34kdmtevjyx

bc1qs3lv77udkap2enxv928x59yuact5df4t95rsqr

bc1qyd05q2m5qt3nwpd3gcqkyer0gspqx5p6evcf7h

bc1qzz7xweq8ee2j35tq6r5m687kctq9huskt50edv

 

See figure 1 for an example of a Cuba ransomware note.

Figure 1: Sample Cuba Ransom Note 2, as of late August 2022

Greetings! Unfortunately we have to report that your company were

compromised. All your files were

encrypted and you can’t restore them without our private key. Trying

to restore it without our help may

cause complete loss of your data. Also we researched whole your

corporate network and downloaded all

your sensitive data to our servers. If we will not get any contact

from you in the next 3 days we will public

it in our news site.

You can find it there (

https[:]// cuba4ikm4jakjgmkeztyawtdgr2xymvy6nvgw5cglswg3si76icnqd.onion/ )

Tor Browser is needed ( https[:]//www.torproject.org/download/ )

Also we respect your work and time and we are open for communication.

In that case we are ready to discuss

recovering your files and work. We can grant absolute privacy and

compliance with agreements by our side.

Also we can provide all necessary evidence to confirm performance of

our products and statements.

Feel free to contact us with quTox ( https[:]//tox.chat/download.html )

 

Our ToxID: 37790E2D198DFD20C9D2887D4EF7C3E295188842480192689864DCCA3C8BD808A18956768271

 

Alternative method is email: [email protected][.]net

 

Mark your messages with your personal ID:

 

 

Additional resources to detect possible exploitation or compromise:

 

MITRE ATT&CK TECHNIQUES

Cuba ransomware actors use the ATT&CK techniques listed in Table 6. Note: For details on TTPs listed in the table, see FBI Flash Indicators of Compromise Associated with Cuba Ransomware.

Table 6: Cuba Ransomware Actors ATT&CK Techniques for Enterprise

Resource Development

Technique Title

ID

Use

Compromise Infrastructure: Domains

T1584.001

Cuba ransomware actors use compromised networks to conduct their operations.

Initial Access

Technique Title

ID

Use

Valid Accounts

T1078

Cuba ransomware actors have been known to use compromised credentials to get into a victim’s network.

External Remote Services

T1133

Cuba ransomware actors may leverage external-facing remote services to gain initial access to a victim’s network.

Exploit Public-Facing Application

T1190

Cuba ransomware actors are known to exploit vulnerabilities in public-facing systems.

Phishing

T1566

Cuba ransomware actors have sent phishing emails to obtain initial access to systems.

Execution

Technique Title

ID

Use

Command and Scripting Interpreter: PowerShell

T1059.001

Cuba ransomware actors have used PowerShell to escalate privileges.

Software Deployment Tools

T1072

Cuba ransomware actors use Hancitor as a tool to spread malicious files throughout a victim’s network.

Privilege Escalation

Technique Title

ID

Use

Exploitation for Privilege Escalation

T1068

Cuba ransomware actors have exploited ZeroLogon to gain administrator privileges.[2]

Defense Evasion

Technique Title

ID

Use

Impair Defenses: Disable or Modify Tools

T1562.001

Cuba ransomware actors leveraged a loader that disables security tools within the victim network.

Lateral Movement

Technique Title

ID

Use

Remote Services Session: RDP Hijacking

T1563.002

Cuba ransomware actors used RDP sessions to move laterally.

Credential Access

Technique Title

ID

Use

Credential Dumping: LSASS Memory

T1003.001

Cuba ransomware actors use LSASS memory to retrieve stored compromised credentials.

Steal or Forge Kerberos Tickets: Kerberoasting

T1558.003

Cuba ransomware actors used the Kerberoasting technique to identify service accounts linked to active directory.[2]

Command and Control

Technique Title

ID

Use

Proxy: Manipulate Command and Control Communications

T1090

Industrial Spy ransomware actors use HTTP/HTTPS proxy via a C2 server to direct traffic to avoid direct connection. [2]

Mitigations

FBI and CISA recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques and to reduce the risk of compromise by Cuba ransomware:

  • Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, the cloud).
  • Require all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts) to comply with National Institute for Standards and Technology (NIST) standards for developing and managing password policies.
    • Use longer passwords consisting of at least 8 characters and no more than 64 characters in length.
    • Store passwords in hashed format using industry-recognized password managers.
    • Add password user “salts” to shared login credentials.
    • Avoid reusing passwords.
    • Implement multiple failed login attempt account lockouts.
    • Disable password “hints.”
    • Refrain from requiring password changes more frequently than once per year.
    • Note: NIST guidance suggests favoring longer passwords instead of requiring regular and frequent password resets. Frequent password resets are more likely to result in users developing password “patterns” cyber criminals can easily decipher.
    • Require administrator credentials to install software.
  • Require multifactor authentication for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.
  • Keep all operating systems, software, and firmware up to date. Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats. Prioritize patching SonicWall firewall vulnerabilities and known exploited vulnerabilities in internet-facing systems. Note: SonicWall maintains a vulnerability list that includes Advisory ID, CVE, and mitigation. Their list can be found at psirt.global.sonicwall.com/vuln-list.
  • Segment networks to prevent the spread of ransomware. Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and by restricting adversary lateral movement.
  • Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool. To aid in detecting the ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network. Endpoint detection and response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.
  • Install, regularly update, and enable real time detection for antivirus software on all hosts.
  • Review domain controllers, servers, workstations, and active directories for new and/or unrecognized accounts.
  • Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege.
  • Disable unused ports.
  • Consider adding an email banner to emails received from outside your organization.
  • Disable hyperlinks in received emails.
  • Implement time-based access for accounts set at the admin level and higher. For example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust model). JIT sets a network-wide policy in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need. Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.
  • Disable command-line and scripting activities and permissions. Privilege escalation and lateral movement often depend on software utilities running from the command line. If threat actors are not able to run these tools, they will have difficulty escalating privileges and/or moving laterally.
  • Maintain offline backups of data, and regularly maintain backup and restoration. By instituting this practice, the organization ensures they will not be severely interrupted, and/or only have irretrievable data.
  • Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure.

RESOURCES

REPORTING

FBI is seeking any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with ransomware actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.

FBI and CISA do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, FBI and CISA urge you to promptly report ransomware incidents immediately. Report to a local FBI Field Office, or CISA at us-cert.cisa.gov/report.

DISCLAIMER

The information in this report is being provided “as is” for informational purposes only. FBI and CISA do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI or CISA.

ACKNOWLEDGEMENTS

FBI and CISA would like to thank BlackBerry, ESET, The National Cyber-Forensics and Training Alliance (NCFTA), and Palo Alto Networks for their contributions to this CSA.

References

Revisions

Initial Version: December 1, 2022

This product is provided subject to this Notification and this Privacy & Use policy.

Source…