DOCSLIB.ORG

Now You See It, Now You Don't: Wipers in the Wild

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Now You See It, Now You Don't: Wipers in the Wild WWW.VIRUSBULLETIN.COM/CONFERENCE 2018MONTREAL 3 – 5 October 2018 NOW YOU SEE IT, NOW YOU global and debilitating WannaCry to the most sophisticated false flag to date, Olympic Destroyer. The minimal use of wipers over DON’T: WIPERS IN THE WILD the last decade and their heightened deployment in recent years Saher Naumaan suggests there has been an evolution in APT behaviour. BAE Systems Applied Intelligence, UK Our case studies of wiper attacks highlight three clear categories of wiper use: espionage, sabotage and diversion. We first look at [email protected] the use of wipers for espionage – we discuss the usual motivations of state actors, and the incorporation of a new tactic, with reference to the unusual appearance of wiper functionality in intrusions. The case studies presented are Flame ABSTRACT and StoneDrill. The next section covers the most commonly Wipers are an APT’s new best friend. Traditionally, it is rare for associated use of wipers: sabotage. Prominent examples include destructive malware to appear in cyber espionage, and it Shamoon, Shamoon 2.0 and DarkSeoul, all of which had the generally runs counter to the conventional interests of an aim of deliberate system destruction. Finally, 2017 and 2018 Advanced Persistent Threat (APT) – such as intelligence have seen the emergence of a new strategy for wiper use – collection, persistence and covert access. But wiper malware is diversion – as demonstrated by Hermes and MBR Killer in the now appearing more often, emerging in APT toolkits, and was Taiwanese and Chilean bank heists. seen in at least four attacks in 2017 following only a handful of This paper argues that wipers have become a routine part of an instances in the previous decade. APT toolkit, though their application isn’t limited to Does this mean the motivations of state actors are changing? We destruction. While wiper functionality always results in the have seen APTs deviate from espionage and branch into destruction of data or systems, this is not always the wiper’s criminal operations such as bank heists and the sabotage of sole intent or purpose. This paper evaluates the use of wipers as critical infrastructure and industrial control systems. From the a new tactic in targeted state-sponsored attacks, looking at debilitating WannaCry to the sophisticated false flag Olympic several examples, and highlights the significance of this trend. Destroyer, the heightened deployment of wipers suggests there has been an evolution in attacker behaviour. ANATOMY AND FUNCTION OF A WIPER This paper examines three different classifications of wipers Destruction, the function of a wiper, is reflected in its anatomy, through examples of various politically targeted attacks: which consists of a destructive payload and a propagation espionage (in the cases of Flame and StoneDrill), sabotage (seen mechanism. However, there are nuances and variations in how a in the cases of Shamoon 2.0 and DarkSeoul) and diversion (seen wiper is constructed and how it executes. in the cases of Hermes and MBR Killer in bank heists in Taiwan and Chile, respectively). Wipers have become a low-cost way for state actors to conduct destructive attacks that serve multiple Payload types purposes – they have significantly more impact on victims and A wiper targets one or a subset of three attack vectors: files, the impede investigation into primarily non-destructive attacks. boot section,1 and the backup of the system and data. • The most unmistakable wiper attack is against files. For INTRODUCTION efficiency purposes, most wipers are selective in their Traditional state-sponsored hacking activity is often focused wiping and won’t overwrite the entire hard disk. Some around cyber espionage, as the primary interests of an Advanced wipers target files with specific extensions, or folders, and Persistent Threat (APT) tend to focus on intelligence collection, some only rewrite enough bytes in each file to destroy the exfiltration of sensitive data, persistence, and covert access. file headers and prevent them from being opened. However, we have also seen APTs deviate from espionage and • Another target of wipers can be the boot section. Such an branch into criminal operations such as bank heists and attack works either by erasing the first 10 sectors of the sabotage through attacks on critical infrastructure and industrial physical disks or by overwriting the first 10 sectors with a control systems (ICS). The nature of state-sponsored attacks is new boot loader, as in the Shamoon attacks (discussed later). changing as their motivations and capabilities evolve. Either way, files aren’t just erased – the original operating The tools used in offensive cyber operations cover a vast range system becomes unbootable because the Master Boot Record and include backdoors, remote access trojans (RATs), implants, (MBR) section of the hard disk has been corrupted.2 and even destructive malware. This range also includes wipers, • If the goal is complete corruption, the malware must also which have existed for years but which have, until now, attack all backups and shadow copies. In Duqu, the remained rare in state-sponsored operations. Wipers are attackers scrubbed the servers – the files weren’t just discussed in the context of targeted attacks, the scope of which does not include criminal ransomware. The following discussion 1 Related targets include file tables and partition tables. is also restricted to wiper malware, precluding other destructive 2 Wipers can and have targeted other elements of the physical disks, malware such as Stuxnet and TRISIS/Triton. including NTFS boot sectors and corresponding Master File Tables (MFTs) and their backups. Even if NTFS boot sector corruptions were In the last 10 years we have witnessed only a handful of major manually resolved, the lack of the MFT would result in files needing to wiper attacks, but their use has escalated since 2016, from the be carved manually from disk. The files themselves are left intact. PAPER PRESENTED AT VB2018 MONTREAL 1 2018MONTREAL WWW.VIRUSBULLETIN.COM/CONFERENCE 3 – 5 October 2018 deleted, but the data had been overwritten to prevent attacks. In fact, Talos has blogged that it has ‘historic examples restoration [1]. of this type of malware [wipers] going back to the 1990s’ [4], The wiper attacks that targeted the Iranian Oil Ministry and referencing variants of the Destover malware that attacked Sony Iranian National Oil Company in April 2012 demonstrated Pictures in 2014. selective and targeted wiping [2]. Most files were wiped with a Instances of wiper use, and even destructive operations in repetitive pattern that ensured every header was destroyed, yet general, have been limited over the last ten years compared to other parts of the files remained intact. The wiper likely other types of intrusions. However, it appears to be an searched for and destroyed files with certain extensions, then increasingly popular tactic, with seven high-profile destructive targeted all files in certain folders, and finally overwrote the disk attacks occurring in the last three years. In most cases, the sectors. The attackers first wiped the malware components, and ultimate aim is destruction, but other cases, such as examples of only then targeted other files in the system, which eventually Lazarus activity, show that wipers are even being used to remove made the machine crash. evidence of their own activity or as a diversion technique. Infection/propagation CLASSIFICATION OF WIPERS As with other malware, a wiper requires a delivery mechanism. In an exploration of wipers in the context of state-sponsored, Some malware uses phishing as an infiltration vector, though in targeted attacks, several examples demonstrate the variety and the case of a wiper, it would be less common and less evolution of wiper use cases. We classify them as three distinct advantageous for an attacker because the goal is usually to use cases. infect as many boxes as possible. A wiper could also theoretically be pushed to all machines on a network, such as in Espionage the case of NotPetya, which compromised victims through a Espionage is ‘an attempt to penetrate an adversarial system for malicious software update of MEDoc. purposes of extracting sensitive or protected information’ [5]. Wiper worms, however, consist of a destructive payload and a The most strategic use of wipers, espionage is primarily directed propagation mechanism, which allows the wiper to spread at collecting intelligence to serve a higher purpose, rather than across machines and networks. NotPetya and Olympic as an instrumental goal-oriented operation. Destroyer are examples of wiper worms, meaning they were able to self-propagate – to remotely copy and execute the wiper Flame/sKyWIper – and perform lateral movement. One of the older cyber espionage operations, Flame was a large-scale and sophisticated campaign that was active for at While conventional understanding of wipers assumes their least five years before its discovery in 2012 in organizations in singular purpose is destruction or disruption [3], the following the Middle East, primarily Iran.3 The Flame malware would case studies show that functionality is different from intent and automatically collect everything from infected machines: purpose. The function of all wipers is destruction, but the intent keystrokes, audio recordings from the internal microphone, behind their destructive capability varies and seems to be evolving. screenshots, documents, and network traffic. The complexity of Flame suggests its purpose was long-term surveillance rather HISTORY OF WIPERS 3 Flame could date back to as early as 2007, around the time Stuxnet Wipers appeared in targeted attacks as early as 2009 with the and Duqu were likely created – one component of Flame was seen in use of Dozer on South Korean targets as part of the DarkSeoul December 2007. Figure 1: Major targeted attacks employing wipers and classifications. 2 PAPER PRESENTED AT VB2018 MONTREAL WWW.VIRUSBULLETIN.COM/CONFERENCE 2018MONTREAL 3 – 5 October 2018 Figure 2: Flame code.
Load more

Recommended publications
  • North Korean Cyber Capabilities: in Brief
    North Korean Cyber Capabilities: In Brief Emma Chanlett-Avery Specialist in Asian Affairs Liana W. Rosen Specialist in International Crime and Narcotics John W. Rollins Specialist in Terrorism and National Security Catherine A. Theohary Specialist in National Security Policy, Cyber and Information Operations August 3, 2017 Congressional Research Service 7-5700 www.crs.gov R44912 North Korean Cyber Capabilities: In Brief Overview As North Korea has accelerated its missile and nuclear programs in spite of international sanctions, Congress and the Trump Administration have elevated North Korea to a top U.S. foreign policy priority. Legislation such as the North Korea Sanctions and Policy Enhancement Act of 2016 (P.L. 114-122) and international sanctions imposed by the United Nations Security Council have focused on North Korea’s WMD and ballistic missile programs and human rights abuses. According to some experts, another threat is emerging from North Korea: an ambitious and well-resourced cyber program. North Korea’s cyberattacks have the potential not only to disrupt international commerce, but to direct resources to its clandestine weapons and delivery system programs, potentially enhancing its ability to evade international sanctions. As Congress addresses the multitude of threats emanating from North Korea, it may need to consider responses to the cyber aspect of North Korea’s repertoire. This would likely involve multiple committees, some of which operate in a classified setting. This report will provide a brief summary of what unclassified open-source reporting has revealed about the secretive program, introduce four case studies in which North Korean operators are suspected of having perpetrated malicious operations, and provide an overview of the international finance messaging service that these hackers may be exploiting.
    [Show full text]
  • 2015 Threat Report Provides a Comprehensive Overview of the Cyber Threat Landscape Facing Both Companies and Individuals
    THREAT REPORT 2015 AT A GLANCE 2015 HIGHLIGHTS A few of the major events in 2015 concerning security issues. 08 07/15: Hacking Team 07/15: Bugs prompt 02/15: Europol joint breached, data Ford, Range Rover, 08/15: Google patches op takes down Ramnit released online Prius, Chrysler recalls Android Stagefright botnet flaw 09/15: XcodeGhost 07/15: Android 07/15: FBI Darkode tainted apps prompts Stagefright flaw 08/15: Amazon, ENFORCEMENT bazaar shutdown ATTACKS AppStore cleanup VULNERABILITY reported SECURITYPRODUCT Chrome drop Flash ads TOP MALWARE BREACHING THE MEET THE DUKES FAMILIES WALLED GARDEN The Dukes are a well- 12 18 resourced, highly 20 Njw0rm was the most In late 2015, the Apple App prominent new malware family in 2015. Store saw a string of incidents where dedicated and organized developers had used compromised tools cyberespionage group believed to be to unwittingly create apps with malicious working for the Russian Federation since behavior. The apps were able to bypass at least 2008 to collect intelligence in Njw0rm Apple’s review procedures to gain entry support of foreign and security policy decision-making. Angler into the store, and from there into an ordinary user’s iOS device. Gamarue THE CHAIN OF THE CHAIN OF Dorkbot COMPROMISE COMPROMISE: 23 The Stages 28 The Chain of Compromise Nuclear is a user-centric model that illustrates Kilim how cyber attacks combine different Ippedo techniques and resources to compromise Dridex devices and networks. It is defined by 4 main phases: Inception, Intrusion, WormLink Infection, and Invasion. INCEPTION Redirectors wreak havoc on US, Europe (p.28) INTRUSION AnglerEK dominates Flash (p.29) INFECTION The rise of rypto-ransomware (p.31) THREATS BY REGION Europe was particularly affected by the Angler exploit kit.
    [Show full text]
  • Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE of CONTENTS 2016 Internet Security Threat Report 2
    Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE OF CONTENTS 2016 Internet Security Threat Report 2 CONTENTS 4 Introduction 21 Tech Support Scams Go Nuclear, 39 Infographic: A New Zero-Day Vulnerability Spreading Ransomware Discovered Every Week in 2015 5 Executive Summary 22 Malvertising 39 Infographic: A New Zero-Day Vulnerability Discovered Every Week in 2015 8 BIG NUMBERS 23 Cybersecurity Challenges For Website Owners 40 Spear Phishing 10 MOBILE DEVICES & THE 23 Put Your Money Where Your Mouse Is 43 Active Attack Groups in 2015 INTERNET OF THINGS 23 Websites Are Still Vulnerable to Attacks 44 Infographic: Attackers Target Both Large and Small Businesses 10 Smartphones Leading to Malware and Data Breaches and Mobile Devices 23 Moving to Stronger Authentication 45 Profiting from High-Level Corporate Attacks and the Butterfly Effect 10 One Phone Per Person 24 Accelerating to Always-On Encryption 45 Cybersecurity, Cybersabotage, and Coping 11 Cross-Over Threats 24 Reinforced Reassurance with Black Swan Events 11 Android Attacks Become More Stealthy 25 Websites Need to Become Harder to 46 Cybersabotage and 12 How Malicious Video Messages Could Attack the Threat of “Hybrid Warfare” Lead to Stagefright and Stagefright 2.0 25 SSL/TLS and The 46 Small Business and the Dirty Linen Attack Industry’s Response 13 Android Users under Fire with Phishing 47 Industrial Control Systems and Ransomware 25 The Evolution of Encryption Vulnerable to Attacks 13 Apple iOS Users Now More at Risk than 25 Strength in Numbers 47 Obscurity is No Defense
    [Show full text]
  • The Dark Reality of Open Source Spotlight Report
    SPOTLIGHT The Dark Reality of Open Source Through the Lens of Threat and Vulnerability Management RiskSense Spotlight Report • May 2020 Executive Summary Open sourCe software (OSS) has quiCkly transformed both And while Heartbleed and the Apache Struts how modern applications are built and the underlying code vulnerabilities are the household names of open source they rely on. Access to high-quality and powerful open vulnerabilities, they are far from the only examples. Open source software projects has allowed developers to quickly source software is increasingly being targeted by integrate new capabilities into their applications without cryptominers, ransomware, and leveraged in DDoS having to reinvent the wheel. As a result, it is now estimated attacks. Unfortunately, OSS vulnerabilities are often a that between 80% and 90% of the code in most modern blind spot for many enterprises, who may not always be applications is made up of open source components. aware of all the open source projects and dependencies Likewise, many of the very tools that have enabled the that are used in their applications. growth of DevOps and CI/CD such as Jenkins, Kubernetes, and Docker are themselves open source projects. With this in mind, we have focused this version of the RiskSense Spotlight report on vulnerabilities in some of OSS also allows organizations to reduce their software today’s most popular open source software, including costs, and is often key to digital transformation efforts more than 50 OSS projects and over 2,600 vulnerabilities. and the transition of services to the cloud. It is no We then used this dataset to provide a risk-based surprise then that a 2020 report from Red Hat found that analysis of open source software to reveal the following: 95% of organizations view open source software as strategically important to their business.
    [Show full text]
  • APT and Cybercriminal Targeting of HCS June 9, 2020 Agenda
    APT and Cybercriminal Targeting of HCS June 9, 2020 Agenda • Executive Summary Slides Key: • APT Group Objectives Non-Technical: managerial, strategic • APT Groups Targeting Health Sector and high-level (general audience) • Activity Timeline Technical: Tactical / IOCs; requiring • TTPs in-depth knowledge (sysadmins, IRT) • Malware • Vulnerabilities • Recommendations and Mitigations TLP: WHITE, ID#202006091030 2 Executive Summary • APT groups steal data, disrupt operations, and destroy infrastructure. Unlike most cybercriminals, APT attackers pursue their objectives over longer periods of time. They adapt to cyber defenses and frequently retarget the same victim. • Common HPH targets include: • Healthcare Biotechnology Medical devices • Pharmaceuticals Healthcare information technology • Scientific research • HPH organizations who have been victim of APT attacks have suffered: • Reputational harm Disruption to operations • Financial losses PII/PHI and proprietary data theft • HC3 recommends several mitigations and controls to counter APT threats. TLP: WHITE, ID#202006091030 3 APT Group Objectives • Motivations of APT Groups which target the health sector include: • Competitive advantage • Theft of proprietary data/intellectual capital such as technology, manufacturing processes, partnership agreements, business plans, pricing documents, test results, scientific research, communications, and contact lists to unfairly advance economically. • Intelligence gathering • Groups target individuals and connected associates to further social engineering
    [Show full text]
  • The Flame: Questions and Answers 1.8
    The Flame: Questions and Answers 1.8 Aleks Kaspersky Lab Expert Posted May 28, 13:00 GMT Tags: Targeted Attacks, Wiper, Cyber weapon, Cyber espionage, Flame Duqu and Stuxnet raised the stakes in the cyber battles being fought in the Middle East – but now we’ve found what might be the most sophisticated cyber weapon yet unleashed. The ‘Flame’ cyber espionage worm came to the attention of our experts at Kaspersky Lab after the UN’s International Telecommunication Union came to us for help in finding an unknown piece of malware which was deleting sensitive information across the Middle East. While searching for that code – nicknamed Wiper – we discovered a new malware codenamed Worm.Win32.Flame. Flame shares many characteristics with notorious cyber weapons Duqu and Stuxnet: while its features are different, the geography and careful targeting of attacks coupled with the usage of specific software vulnerabilities seems to put it alongside those familiar ‘super­weapons’ currently deployed in the Middle East by unknown perpetrators. Flame can easily be described as one of the most complex threats ever discovered. It’s big and incredibly sophisticated. It pretty much redefines the notion of cyberwar and cyberespionage. For the full low­down on this advanced threat, read on… General Questions What exactly is Flame? A worm? A backdoor? What does it do? Flame is a sophisticated attack toolkit, which is a lot more complex than Duqu. It is a backdoor, a Trojan, and it has worm­like features, allowing it to replicate in a local network and on removable media if it is commanded so by its master.
    [Show full text]
  • Potential Human Cost of Cyber Operations
    ICRC EXPERT MEETING 14–16 NOVEMBER 2018 – GENEVA THE POTENTIAL HUMAN COST OF CYBER OPERATIONS REPORT ICRC EXPERT MEETING 14–16 NOVEMBER 2018 – GENEVA THE POTENTIAL HUMAN COST OF CYBER OPERATIONS Report prepared and edited by Laurent Gisel, senior legal adviser, and Lukasz Olejnik, scientific adviser on cyber, ICRC THE POTENTIAL HUMAN COST OF CYBER OPERATIONS Table of Contents Foreword............................................................................................................................................. 3 Acknowledgements ............................................................................................................................. 4 Executive summary ............................................................................................................................. 5 Introduction....................................................................................................................................... 10 Session 1: Cyber operations in practice .………………………………………………………………………….….11 A. Understanding cyber operations with the cyber kill chain model ...................................................... 11 B. Operational purpose ................................................................................................................. 11 C. Trusted systems and software supply chain attacks ...................................................................... 13 D. Cyber capabilities and exploits ..................................................................................................
    [Show full text]
  • A PRACTICAL METHOD of IDENTIFYING CYBERATTACKS February 2018 INDEX
    In Collaboration With A PRACTICAL METHOD OF IDENTIFYING CYBERATTACKS February 2018 INDEX TOPICS EXECUTIVE SUMMARY 4 OVERVIEW 5 THE RESPONSES TO A GROWING THREAT 7 DIFFERENT TYPES OF PERPETRATORS 10 THE SCOURGE OF CYBERCRIME 11 THE EVOLUTION OF CYBERWARFARE 12 CYBERACTIVISM: ACTIVE AS EVER 13 THE ATTRIBUTION PROBLEM 14 TRACKING THE ORIGINS OF CYBERATTACKS 17 CONCLUSION 20 APPENDIX: TIMELINE OF CYBERSECURITY 21 INCIDENTS 2 A Practical Method of Identifying Cyberattacks EXECUTIVE OVERVIEW SUMMARY The frequency and scope of cyberattacks Cyberattacks carried out by a range of entities are continue to grow, and yet despite the seriousness a growing threat to the security of governments of the problem, it remains extremely difficult to and their citizens. There are three main sources differentiate between the various sources of an of attacks; activists, criminals and governments, attack. This paper aims to shed light on the main and - based on the evidence - it is sometimes types of cyberattacks and provides examples hard to differentiate them. Indeed, they may of each. In particular, a high level framework sometimes work together when their interests for investigation is presented, aimed at helping are aligned. The increasing frequency and severity analysts in gaining a better understanding of the of the attacks makes it more important than ever origins of threats, the motive of the attacker, the to understand the source. Knowing who planned technical origin of the attack, the information an attack might make it easier to capture the contained in the coding of the malware and culprits or frame an appropriate response. the attacker’s modus operandi.
    [Show full text]
  • Society's Genome.Indb
    Society’s Genome Genetic Diversity’s Role in Digital Preservation By Nathan Thompson with Bob Cone and John Kranz Copyright © 2016 by Spectra Logic Corporation All rights reserved. No part of this book may be reproduced in any form or by any electronic or mechanical means, including storage and retrieval systems—except in the case of brief quotations embodied in critical articles or reviews—without permission in writing from Spectra Logic Corporation. All product names, logos, and brands mentioned in this book are the property of their respective owners. Neither the authors nor publisher claim any right of ownership to such names, logos, and brands. Cover design by Kristen Coats Back cover image: Detail of “Ptolemy World Map,” from Ptolemy’s the Geography, redrawn by Francesco di Antonio del Chierco (15th century). Housed in the British Library, London. Image retrieved from https:// commons.wikimedia.org/wiki/File:PtolemyWorldMap.jpg. Published by Spectra Logic Corporation 6285 Lookout Road Boulder, Colorado 80301-3580 Tel.: 1.800.833.1132 Fax: 1.303.939.8844 www.spectralogic.com ISBN: 978-0-9975644-0-2 Second Printing Printed and bound in the United States of America 10 9 8 7 6 5 4 3 2 1 This book is printed on acid-free paper. “We are survival machines—robot vehicles blindly programmed to preserve the selfish molecules known as genes. This is a truth that still fills me with astonishment.” —Richard Dawkins, The Selfish Gene Chapter 6 Wolves at the Door Just a few years after the 9/11 attacks, the digital world began showing signs of sudden, profound change.
    [Show full text]
  • Detecting Botnets Using File System Indicators
    Detecting botnets using file system indicators Master's thesis University of Twente Author: Committee members: Peter Wagenaar Prof. Dr. Pieter H. Hartel Dr. Damiano Bolzoni Frank Bernaards LLM (NHTCU) December 12, 2012 Abstract Botnets, large groups of networked zombie computers under centralised control, are recognised as one of the major threats on the internet. There is a lot of research towards ways of detecting botnets, in particular towards detecting Command and Control servers. Most of the research is focused on trying to detect the commands that these servers send to the bots over the network. For this research, we have looked at botnets from a botmaster's perspective. First, we characterise several botnet enhancing techniques using three aspects: resilience, stealth and churn. We see that these enhancements are usually employed in the network communications between the C&C and the bots. This leads us to our second contribution: we propose a new botnet detection method based on the way C&C's are present on the file system. We define a set of file system based indicators and use them to search for C&C's in images of hard disks. We investigate how the aspects resilience, stealth and churn apply to each of the indicators and discuss countermeasures botmasters could take to evade detection. We validate our method by applying it to a test dataset of 94 disk images, 16 of which contain C&C installations, and show that low false positive and false negative ratio's can be achieved. Approaching the botnet detection problem from this angle is novel, which provides a basis for further research.
    [Show full text]
  • 25 AUG 2021 MC-000150-MW Indicators of Compromise Associated with Hive Ransomware
    TLP:WHITE The following information is being provided by the FBI, with no guarantees or warranties, for potential use at the sole discretion of 25 AUG 2021 recipients in order to protect against cyber threats. This data is provided to help cyber security professionals and system Alert Number administrators guard against the persistent malicious actions of cyber MC-000150-MW actors. This FLASH was coordinated with DHS-CISA. This FLASH has been released TLP:WHITE. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. Indicators of Compromise Associated with Hive Ransomware Summary Hive ransomware, which was first observed in June 2021 and likely operates as an affiliate-based ransomware, employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Hive ransomware uses multiple mechanisms to compromise business networks, including phishing emails with malicious attachments to gain access and Remote Desktop Protocol (RDP) to move laterally once on the network. After compromising a victim network, Hive ransomware actors exfiltrate data and encrypt files on the network. The actors leave a ransom note in each affected directory within a victim’s system, which provides instructions on how to purchase the decryption software. The ransom note also threatens to leak exfiltrated victim data on the Tor site, “HiveLeaks.” TLP:WHITE TLP:WHITE Technical Details Hive ransomware seeks processes related to backups, anti-virus/anti-spyware, and file copying and terminates them to facilitate file encryption. The encrypted files commonly end with a .hive extension. The Hive ransomware then drops a hive.bat script into the directory, which enforces an execution timeout delay of one second in order to perform cleanup after the encryption is finished by deleting the Hive executable and the hive.bat script.
    [Show full text]
  • October 28, 2013 CRYPTOLOCKER RANSOMWARE ENCRYPTS USER’S FILES
    October 28, 2013 CRYPTOLOCKER RANSOMWARE ENCRYPTS USER’S FILES The FBI is aware of a file-encrypting Ransomware known as CryptoLocker. Businesses are receiving emails with alleged customer complaints containing attachments that when opened, appear as a window that is in fact a malware downloader. This downloader installs the actual CryptoLocker malware. The verbiage in the window states that important files have been encrypted using a unique public key generated for the computer. To decrypt the files you must obtain the private key. A copy of the private key is located on a remote server that will destroy the key after the specified time shown in the window. The attackers demand payment of a ransom ranging from $100 to $300 to decrypt the files. *Unfortunately, once the encryption of the files is complete, decryption is not feasible. To obtain the file specific Advanced Encryption Standard (AES) key to decrypt a file, you need the private RSA key (an algorithm for public key cryptography) corresponding to the RSA public key generated for the victim’s system by the command and control server. However, this key never leaves the command and control server, putting it out of reach of everyone except the attacker. The recommended solution is to scrub your hard drive and restore encrypted files from a backup. As with any virus or malware, the way to avoid it is with safe browsing and email habits. Specifically, in this case, be wary of email from senders you don’t know, and never open or download an attachment unless you’re sure you know what it is and that it’s safe.
    [Show full text]