By Mathew J. Schwartz (euroinfosec)
Ransomware-wielding gangs, in their ongoing pursuit of new ways to successfully shake down victims, keep innovating. Many continue to refine not just their business model but also their technology in an attempt to make their malware tougher to block and encrypted files tougher to crack.
To the list of tricks being deployed by ransomware gangs, add this new move: The RagnarLocker gang has been using full virtual machines to try to hide their crypto-locking malware to enable it to forcibly encrypt a victim’s systems, security firm Sophos warns.
“In a recently detected attack, Ragnar Locker ransomware was deployed inside an Oracle VirtualBox Windows XP virtual machine,” Sophos reports in a blog post. “The attack payload was a 122 MB installer with a 282 MB virtual image inside – all to conceal a 49 KB ransomware executable.”
“This is the first time we have seen virtual machines used for ransomware,” says director of engineering at Sophos, Mark Loman.
The security firm declined to name the victim, the sector in which they operate, or how much the Ragnar gang was demanding as a ransom.
If It Works, It’s Not Overkill
Bringing a massive installer to bear on a system, simply to run a small piece of malware, is without a doubt ostentatious. But is it effective?
“The overhead involved to covertly run their 50 KB ransomware seems like a bold, noisy move, but could pay off in some networks that are not properly protected against ransomware,” Loman says.
In the attack Sophos studied, the attackers used a Group Policy Objects task to run an executable that downloaded the 122 MB installer file from an external server. That installer included an executable and support files, but primarily a virtual machine: an old Oracle VirtualBox hypervisor, which Sophos notes is technically “Sun xVM VirtualBox version 3.0.4 from Aug. 5, 2009. Oracle bought Sun Microsystems in 2010.”
Sophos: “The virtualization software and the virtual disk image are copied to the folder C:Program Files (x86)VirtualAppliances.”
“They are deploying a well-known trusted hypervisor to hundreds of endpoints simultaneously, together with a preinstalled and preconfigured virtual disk image guaranteed to run their ransomware,” Loman says.
The next part of the attack involves the VM installing a virtual disk image file called “micro.vdi” which is “a stripped-down version of the Windows XP SP3 operating system, called MicroXP v0.82,” that includes the tiny RagnarLocker executable, Sophos says. It then gets compiled for just that victim.
Ransomware Deletes Shadow Copies
Leader, SentinelLabs at security firm SentinelOne and one who has analyzed Ragnar’s ransomware, Vitali Kremez says it includes features designed to make it difficult for victims to restore their systems. On May 1, Kremez reported that a new version of RagnarLocker was disabling the built-in Windows Defender anti-virus software on victims’ systems, and it might also be using the EternalBlue exploit against a long-patched flaw in Windows SMB_v1 to help spread.
Indeed, as part of the attack detailed by Sophos, a script deletes volume shadow copies to block victims from restoring older versions of their files. Many strains of ransomware now employ this tactic.
The script also enumerates “all local disks, connected removable drives and mapped network drives on the physical machine, so they can be configured to be accessed from within the virtual machine,” Sophos says.
After stopping numerous operating system processes, the ransomware mounts all available network drives, encrypts all files on them and drops a ransom note.
“Since the vrun.exe ransomware application runs inside the virtual guest machine, its process and behaviors can run unhindered, because they’re out of reach for security software on the physical host machine,” Sophos says.
Ragnar Gang: RDP Experience
RagnarLocker is also known as Ragnarök, which is the name of a battle at the end of the world in Norse mythology. The RagnarLocker name could be a play on Ragnar Lodbrok, a mythical Viking hero and Danish king also from Norse mythology. (Ragnar is Norse for warrior.) Security experts say there appears to be a single gang behind RagnarLocker attacks, but whether they’re Scandinavian remains unknown.
In a recent report, Microsoft called out RagnarLocker as being one of four strains of ransomware – along with Maze, RobbinHood and Vatet loader – that regularly get dropped onto systems after attackers gain remote access using stolen or brute-forced RDP credentials.
Microsoft notes that the Ragnar gang “heavily uses RDP and Cobalt Strike with stolen credentials.” Using RDP gives the gang remote access to a network. Once they have a foothold, they can use Cobalt Strike, a legitimate penetration testing framework, to help gain administrator-level access to endpoints.
After that, the group may use “native Windows administrative tools such as PowerShell” – a task-based, command-line shell and scripting language in Windows – “and Windows Group Policy Objects (GPOs) to move laterally across the network to Windows clients and servers,” Sophos says.
Gang Leaks Victims’ Data
RagnarLocker is also one of about a dozen gangs that have been tied to not just infecting systems with ransomware, but first stealing data in an attempt to gain more leverage over victims.
For victims that refuse to pay the gang’s ransom demand, attackers first try to name and shame them, typically via a dedicated leaks site, before trickling out data to try and force payment. In many cases, if the victim doesn’t pay, the gang will dump all of the stolen data online for anyone to download, as a lesson to future victims.
Percentage of organizations that paid a ransom after their data was encrypted in a ransomware attack .
RagnarLocker Victim: Energias de Portugal
In April, the Ragnarok gang, wielding RagnarLocker, attempted to extort 1,580 bitcoins – worth about €10 million (US$11 million) at the time – from Energias de Portugal, a major Portuguese electric utilities company based in Lisbon. Attackers claimed to have stolen 10 TB of data from EDP.
In the case of the EDP attack, “the actors were in the victim’s network for some time before running the [ransomware],” the anti-malware group MalwareHunterTeam reports.
Ransomware incident response firm Coveware reports that based on the more than 1,000 cases it investigated in the first three months of this year, 8.7 per cent involved data exfiltration .
The Maze ransomware gang has started releasing payment card data from an attack that happened earlier this year at Banco BCR, which is the state-owned Bank of Costa Rica, according to several cybersecurity experts.
In a post to its darknet portal website, the operators of Maze announced on Thursday that they planned to start releasing payment card data related to the ransomware attack at Banco BCR, according to security firm Emsisoft, which shared the posting with Information Security Media Group.
“We apologize in front of all clients of Banco BCR and all those who were using its services for publishing your personal data. We regret that Banco BCR and regulators don’t care about their clients and their personal date,” according to the post.
Recently, security firm Cyble published a report from its researchers that confirmed a 2 GB CSV file posted by the gang contained data from Banco BCR. This included details such as MasterCard and Visa credit card numbers as well as debit card numbers.
On May 1, BleepingCmputer first reported that Maze had attacked Banco BCR, encrypted data and stole files. At the time, the gang claimed it was in possession of some 4 million unique payment card numbers, including 140,000 allegedly belonging to U.S. customers.
In an earlier post to its darknet site that ISMG has seen, Maze claims to have first gained access to the bank’s internal networks in August 2019. The ransomware operators told BleepingComputer that they regained access in February but held off attacking and encrypting data due to the COVID-19 pandemic.
The Maze gang has claimed that they attempted to contact Banco BCR representatives about the ransomware attack, but have not heard back. There is no information about the breach posted on the bank’s website and a spokesperson could not be immediately reached for comment.
The history of Banco BCR dates back to the late 1870s, when the bank was founded. Banco BCR currently manages about US$7 billion in assets, according to its website.
Ongoing Ransomware Attacks
Over the past several months, the operators of Maze have turned into one of the more prolific ransomware gangs. This includes attacks directed against Switzerland-based global insurance firm Chubb, and IT services and consulting giant Cognizant – although the gang has denied involvement in that particular incident.
In addition, Maze was one of the first ransomware gangs to start leaking data when its targets did not negotiate with the gang or did not come up with enough money to satisfy the ransom demands.
Maze first started this trend of publishing its targets’ data in November 2019 and other cybercriminal groups, including DoppelPaymer, MegaCortex, Nemty, Snatch and Sodinokibi, aka REvil, have followed.
A threat analyst with Emsisoft who has been following these developments, Brett Callow says that Maze’s recent release of customers’ payment card data from Banco BCR is another example of cybercriminals weaponizing the information that they have stolen.
Maze’s announcement about Banco BCR
“Like other groups, Maze now weaponizes the data it steals,” Callow tells ISMG. “The information is no longer simply published online; it’s used to harm companies’ reputations and attack their business partners and customers.”
In this most recent security incident with Banco BCR, Callow says the gang is trying to portray itself as doing a service by calling attention to the bank not protecting its network, but that’s not the real issue.
“The Maze group is a for-profit criminal enterprise who are out to make a buck,” Callow says. “The credit card information has been posted for one of two reasons: Either to pressure BCR into paying and/or to demonstrate the consequences of non-compliance to their future victims.”
Over the last two weeks, the operators of the REvil ransomware have adopted similar strong-arm tactics by threating to release legal documents and other data from a high-powered New York law firm that represents several A-list celebrities .
- Managing Editor Scott Ferguson contributed to this report.
