In August 2023, the Sophos X-Ops Incident Response group was engaged to help a company in Australia contaminated with Cash Message ransomware. This assault vector, recognized for its stealth, doesn’t append any file extensions to the encrypted information, making it tougher for victims to determine the encrypted recordsdata just by recognizing such extensions.
On this put up, we are going to take a look at the incident assault circulation, illustrating how risk actors are deploying the Cash Message ransomware and what measures can fight attacker efforts at varied factors alongside the MITRE ATT&CK chain.
Make a remark of it
As a part of its routine, the ransomware drops a ransom observe named “money_message.log” straight into the foundation listing of the C: drive.
The ransom observe on the goal’s system learn as follows:
Your recordsdata was encrypted by “Cash message” worthwhile group and may’t be accessed anymore.
In case you pay ransom, you’re going to get a decryptor to decrypt them. Don’t attempt to decrypt recordsdata your self – in that case they are going to be broken and unrecoverable.
For additional negotiations open this <redacted>.onion/<redacted>
utilizing tor browser https://www.torproject.org/obtain/
In case you refuse to pay, we are going to put up the recordsdata we stole out of your inside community, in our weblog:
<redacted>.onion
Encrypted recordsdata can’t be decrypted with out our decryption software program.
<redacted>.onion/<redacted>
Assault Move Particulars
Preliminary Entry
Our investigation signifies that the attacker gained preliminary entry through the goal’s VPN, which was utilizing single-factor authentication. That is an instance of MITRE’s T1078 – Legitimate Accounts approach.
Steerage
Implementing multifactor authentication (MFA) for VPN connections is paramount to boost safety and thwart potential unauthorized entry. Moreover, steady monitoring of VPN logs and person exercise needs to be in place to promptly detect any suspicious login makes an attempt or anomalies. Upgrading to a extra strong and layered authentication method, akin to MFA, is crucial to bolster the primary line of protection towards potential risk actors searching for to use single-factor vulnerabilities and achieve unauthorized VPN entry.
Protection Evasion
The risk actor deployed GPO Coverage to disable Home windows Defender real-time safety. That is an instance of MITRE’s T1562.001: Impair Defenses: Disable or Modify Instruments sub-technique.
[HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows Defender] DisableAntiSpyware: [REG_DWORD_LE] 1 [HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows DefenderReal-time Protection] DisableRealtimeMonitoring: [REG_DWORD_LE] 1
Steerage
The primary line of protection obtainable to organizations is to make use of a safety agent that has strong tamper safety. By way of monitoring for this exercise, these are detection-ready occasion sources. Whereas it’s attainable a system administrator would disable these protections (at the least briefly) throughout troubleshooting, given the chance of this exercise, it’s one thing that needs to be investigated promptly if a corresponding help ticket isn’t discovered.
Lateral Motion
The risk actor leveraged psexec to run a batch script with the intention of enabling the RDP port, subsequently utilizing Distant Desktop Protocol (RDP) to traverse the community. That is an instance of MITRE’s T1021.001: Distant Providers: Distant Desktop Protocol sub-technique. RDP is a standard discovering in instances dealt with by Incident Response, as proven by our findings from IR instances dealt with throughout the first half of 2023.
Determine 1: RDP abuse detections in IR instances for the primary half of 2023
The batch script contents are as follows:
reg add "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f Allow-NetFirewallRule -DisplayGroup 'Distant Desktop' netsh advfirewall firewall add rule identify="Open Distant Desktop" protocol=TCP dir=in localport=3389 motion=permit
Steerage
Securing RDP entry might be troublesome for a lot of firms, however it’s a challenge worthy of funding. The primary merchandise to test off the field is to limit, by function, which accounts can entry different techniques utilizing RDP. The overwhelming majority of customers don’t want this entry. Secondly, adopting a centralized soar server, which solely admins can entry with MFA and blocking on the community stage different system-to-system RDP is a robust preventative management. Lastly, a detection needs to be in place to promptly evaluation anomalous RDP connections to deconflict them with accredited system administration exercise.
Credential Entry
The risk actor, utilizing Secretsdump.py (a part of the Impacket toolkit), retrieved the SAM registry hive. That is an instance of a technique of executing MITRE’s T1003.002: OS Credential Dumping: Safety Account Supervisor subtechnique.
C:WINDOWSsystem32svchost.exe -k localService -p -s RemoteRegistry
Steerage
It’s essential for organizations to prioritize the safeguarding of delicate credentials. Implementing sturdy entry controls, using strong endpoint detection and response options, and monitoring for any suspicious exercise associated to SAM hive entry are important steps. Any unauthorized makes an attempt to entry or manipulate this essential system part needs to be promptly investigated, as they might point out a breach or malicious exercise that would compromise the safety of delicate credentials.
Assortment
A confirmed compromised account was used to entry delicate folders like Finance, Payroll, SalesReport and HR in FileServer. MITRE lists 37 sub- and sub-sub-techniques beneath TA0009: Assortment.
Steerage
Usually by the point a risk actor is staging information, it’s too late to have a superb safety consequence. A superb method to forestall theft of knowledge is to undertake least-privilege entry, which implies guaranteeing solely the required folks have entry, adopted by granular controls on exporting, sharing, or transferring the recordsdata. DLP options, whereas having a historical past of being troublesome to implement and keep, are value evaluating for high-risk information.
Exfiltration
The risk actor leveraged MEGAsync to exfiltrate the information. That is an instance of MITRE’s T1567.002: Exfiltration Over Internet Service: Exfiltration to Cloud Storage.
UserAssist entry: 87 Worth identify: C:Customers<redacted>AppDataLocalTemp6MEGAsyncSetup32.exe Depend: 1 Person ”<redacted> registered Process Scheduler job “MEGAMEGAsync Replace Process S-1-5-21-<redacted>"
Steerage
Organizations ought to give attention to enhancing information loss prevention measures and community monitoring. Implementing strong outbound visitors evaluation and content material inspection may help determine and block suspicious information transfers. Moreover, intently monitoring MEGAsync actions and detecting any uncommon or unauthorized information transfers might be important in mitigating information breaches. Quickly examine and reply to any indicators of unauthorized exfiltration to forestall potential information compromise and reduce the impression on information confidentiality.
Affect
The risk actor leveraged two ransomware binaries, one for the Home windows atmosphere and one for the Linux atmosphere. The Home windows model is called home windows.exe, and is detected as Troj/Ransom-GWD by Sophos. That is an instance of MITRE’s T1486: Information Encrypted for Affect.
- The Cash Message encryptor is written in C++ and consists of an embedded JSON configuration file which incorporates some key particulars like what folders to dam from encrypting, what extension to append, what companies and processes to terminate, and area login names and passwords possible used to encrypt different gadgets.
- The encryptor makes use of the ChaCha Quarter Spherical algorithm and ECDH encryption
- The ransomware creates the C:money_message.log ransom observe when full
- On endpoints protected with Sophos, the next detection is triggered:
Malware detected: ‘Troj/Ransom-GWD’ at ‘C:Customers<redacted>AppDataLocalTemp6windows.exe’
The Linux variant is called ‘esxi’, Upon execution it can delete all of the digital laborious disks. That is an instance of MITRE’s T1561: Disk Wipe.
Instructions executed on ESXi host:
cd /tmp/ chmod 777 esxi dir ls ./esxi
Steerage
As talked about earlier, at this late stage within the assault, having full protection on all techniques with a correctly configured XDR answer is significant to guard organizations from ransomware. Within the case of Sophos, it’s essential for patrons to have their CryptoGuard coverage activated, which is one thing help can information prospects on.
Conclusion
The Cash Message attackers’ path to exfiltration conforms to a reasonably typical MITRE ATT&CK chain, as we’ve got proven above. Although this explicit attacker tries to muddy the waters for defenders, good protection – particularly within the early phases – can present an efficient toolkit towards unhealthy outcomes.