Ryuk

The Ryuk Actors will then have access to the infected computer and begin to perform reconnaissance of the network.

some ransomware gangs are now cold-calling victims on their phones if they suspect that a hacked company might try to restore from backups and avoid paying ransom demands.

“APT1 has created email accounts for later use in social engineering, phishing…” / “Operation Wocao… registered email accounts to use during the campaign.”

the group has continued to host a significant proportion of the C&C infrastructure in the networks of Choopa, a U.S.-based VPS hosting provider

Ryuk ransomware operators extorted victim companies by demanding ransom payments in Bitcoin in exchange for decryption keys.

The operators used professional money-flow techniques and created unique ProtonMail addresses for each victim to improve operational security and avoid detection.

APT1 has created email accounts for later use in social engineering, phishing, and when registering domains. APT42 has created email accounts to use in spearphishing operations. Contagious Interview has created fake email accounts to correspond with social media accounts, fake LinkedIn personas, code repository accounts, and job announcements on development job board services.

Emotet was born as a banking trojan, it evolved in time and became highly modular threat... Emotet can be used as an initial payload... has been observed to drop additional malware in the infected systems.

The U.S. and German government’s action today addresses the abuse of virtual currency to launder ransom payments.

Karen Serobovich Vardanyan ... specialized in gaining initial access to corporate networks.

Prosecutors previously accused Vardanyan and his co-conspirators ... of illegally accessing computer networks to deploy Ryuk ransomware.

Method Discussed by Hackers and their Interest: Exploiting vulnerabilities... Webservers and application servers need to be updated/patched to prevent attacks such as remote code execution (RCE)

phishing and spam messages containing installers for dangerous malware are still circulating around the web and reaching victims.

Typically this is achieved by sending out spam emails containing a document with a malicious macro that will download the bot if the victim allows the execution of macros.

phishing emails containing malicious attachments ... or links

The adversaries used the command-line tool BitsAdmin, as well as WMIC and PsExec with privileged account credentials to copy Ryuk to additional hosts.

the adversaries had gained domain access and used that to deploy the Ryuk ransomware through a series of scheduled tasks

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Eventually, TrickBot is known to open a reverse shell back to the Ryuk Ransomware actors so that they can encrypt the entire compromised network.

They also sent Wake-On-Lan magic packets to wake shut-down hosts for encryption. The adversaries used PowerShell to disable real-time monitoring malware protection and a PowerShell cmdlet code “Get-DataInfo.ps1” to scan the network and provide an output of live or dead hosts in text files.

Ryukがサービスを強制終了させる際は以下のコマンドを使用します。 net stop <サービス名> /y Ryukがプロセスを強制終了させる際は以下のコマンドを使用します。 taskkill /IM <プロセス名> /F

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Batch script that uses WMIC to execute a BITSAdmin transfer of a payload ransomware to each targeted machine in the comps<##>.txt files.

Finally, before terminating, the dropper calls ShellExecuteW to execute the Ryuk ransomware payload it has just written.

Image11: Ryuk detonated via PsExec

the adversaries had gained domain access and used that to deploy the Ryuk ransomware through a series of scheduled tasks

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Karen Serobovich Vardanyan ... specialized in gaining initial access to corporate networks.

To make sure the malware is executed after reboot, Ryuk uses a straight forward persistence technique, whereby it writes itself to the Run registry key

Prosecutors previously accused Vardanyan and his co-conspirators ... of illegally accessing computer networks to deploy Ryuk ransomware.

Un utilisateur local nommé « terminal » peut être créé sur la machine compromise.

Batch script that uses WMIC to execute a BITSAdmin transfer of a payload ransomware to each targeted machine in the comps<##>.txt files.

MITRE ATT&CK Command and Scripting Interpreter T1059 Native API T1106 Application Shimming T1546.011 Process Injection T1055

Examples include 'adds Registry Run keys to establish persistence', 'creates a shortcut in the Startup folder', and 'RunOnce Registry key to run itself on safe mode.'

旧Ryukには、C:¥Users¥Public¥フォルダ内に自身をコピーし、そのパスをレジストリの自動起動エントリーに登録するなど、新Ryukにはない動作も存在します。

the adversaries had gained domain access and used that to deploy the Ryuk ransomware through a series of scheduled tasks

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

インジェクションの手口は、マルウェアにおいては非常にスタンダードなWriteProcessMemoryによるもので、自分自身をインジェクションし、相手のプロセス内からも不正活動を開始させます。

ROKRAT can use VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread to execute shellcode within the address space of Notepad.exe. Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread.

ROKRAT can use VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread to execute shellcode within the address space of Notepad.exe. Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread. Woody RAT can inject code into a targeted process by writing to the remote memory of an infected system and then create a remote thread.

Karen Serobovich Vardanyan ... specialized in gaining initial access to corporate networks.

It will then try to elevate to SeDebugPrivilege so as to have extended capabilities in subsequent actions

Privilege Escalation (TA0029) — T1484 Group Policy Modification: Force group policy update that creates service to execute ransomware

In at least one incident, FIN12 used GPOs, scheduled tasks, and WebDAV to execute a RYUK payload hosted on a network file share.

MITRE ATT&CK Command and Scripting Interpreter T1059 Native API T1106 Application Shimming T1546.011 Process Injection T1055

Examples include 'adds Registry Run keys to establish persistence', 'creates a shortcut in the Startup folder', and 'RunOnce Registry key to run itself on safe mode.'

旧Ryukには、C:¥Users¥Public¥フォルダ内に自身をコピーし、そのパスをレジストリの自動起動エントリーに登録するなど、新Ryukにはない動作も存在します。

Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.

crypters, which are also referred to as loaders or packers, are applications designed to encrypt and obfuscate malware to evade detection by antivirus (AV) scanners and hinder analysis.

Since at least February 2020, FIN12 has leveraged a series of in-memory droppers including, MALTSHAKE, ICECANDLE, WHITEDAGGER, WEIRDLOOP, and templates associated with Cobalt Strike's Artifact Kit to deploy various malware payloads.

It is started by decrypting a list of API function name strings using a predefined key and an array of the string lengths which is then used to dynamically load the corresponding functions.

Obfuscation and polymorphic nature of malware make them more difficult to identify by Antivirus system.

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

(Ryuk table) “Masquerading: Match Legitimate Name or Location [T1036.005]… constructed legitimate appearing installation folder paths…”

インジェクションの手口は、マルウェアにおいては非常にスタンダードなWriteProcessMemoryによるもので、自分自身をインジェクションし、相手のプロセス内からも不正活動を開始させます。

ROKRAT can use VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread to execute shellcode within the address space of Notepad.exe. Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread.

ROKRAT can use VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread to execute shellcode within the address space of Notepad.exe. Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread. Woody RAT can inject code into a targeted process by writing to the remote memory of an infected system and then create a remote thread.

To ensure the victim is forced to pay to decrypt the valuable files, Ryuk changes the configuration of and deletes the Virtual Shadow Copy.

If such was passed, it will use it as a path to a file that is deleted using DeleteFileW. Based on the malware’s dropper code, this argument would be the path to the dropper itself.

Karen Serobovich Vardanyan ... specialized in gaining initial access to corporate networks.

It will then try to elevate to SeDebugPrivilege so as to have extended capabilities in subsequent actions

In the most recent version, Ryuk obfuscates its hardcoded strings to become more difficult for AV vendors to detect.

Batch script that uses WMIC to execute a BITSAdmin transfer of a payload ransomware to each targeted machine in the comps<##>.txt files.

実際の攻撃事例でも、PsExecを利用しRyukを管理者権限で展開するケースが確認されています。

Following this, the malware will attempt to write a dummy file to the Windows directory, which would only be allowed with Admin privileges. If the creation of the file failed, it will sleep for a while and attempt the same another five times.

MITRE ATT&CK ... Virtualization/Sandbox Evasion T1497.001 ...

To make sure the malware is executed after reboot, Ryuk uses a straight forward persistence technique, whereby it writes itself to the Run registry key

The adversaries then tried to expand the number of affected hosts by granting full permission for all users for all files on all mounted disk drives with icacls.exe.

“used the icacls command to modify access control, giving them full control of all the system folders on the server.”

Privilege Escalation (TA0029) — T1484 Group Policy Modification: Force group policy update that creates service to execute ransomware

In at least one incident, FIN12 used GPOs, scheduled tasks, and WebDAV to execute a RYUK payload hosted on a network file share.

FIN12 has frequently leveraged code-signed payloads in their operations.

To reduce the likelihood of being detected by an antimalware product, TrickBot also tries to disable and delete Windows Defender.

The following analytic identifies potential Remote Desktop Protocol (RDP) brute force attacks by monitoring network traffic for RDP application activity.

The following analytic identifies potential Remote Desktop Protocol (RDP) brute force attacks by monitoring network traffic for RDP application activity... identifying source IPs that have made more than 10 successful connection attempts to the same RDP port on a host within a one-hour window.

The adversaries compromised a domain administrator account by recovering the password stored in a Group Policy.

具体的には、現在のネットワークアダプタに関連付けられた端末のIPアドレスを取得し、[10.][172.16.][192.168.]で始まるかどうか(つまりプライペートIPの範囲かどうか)を調べます。

After gaining access to a Windows domain controller, the attackers then deploy the Ryuk ransomware on the network to encrypt all of its devices...

Ryukの該当機能は、「NT AUTHORITY」(つまりシステム関連)に属するプロセスのリストを作成し、それらのうち「csrss.exe」「explorer.exe」「lsass.exe」以外の全プロセスを対象にインジェクションを行います。

Ryukは上記のように眠っていた端末を起こした後、ping送信による疎通確認を利用してネットワーク上に現存する端末を探索していきます。

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

title: Suspicious Group And Account Reconnaissance Activity Using Net.EXE ... Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE ... tags: - attack.discovery - attack.t1087.001 - attack.t1087.002

selection_accounts_root: CommandLine|contains: ' accounts ' ... selection_accounts_flags: CommandLine|contains: ' /do' # short for domain ... tags: - attack.discovery - attack.t1087.001 - attack.t1087.002

"Babuk can enumerate disk volumes, get disk information"; "Ryuk has called GetLogicalDrives ... and GetDriveTypeW"; "Cuba can enumerate local drives, disk type, and disk free space"; "Chimera ... fsutil fsinfo drives"

MITRE ATT&CK ... System Time Discovery T1124 ...

Ryuk encrypts both local drives and network shares.

Simulated execution of T1482 from Atomic Red Team, mimicking Ryuk Ransomware actor tradecraft.

Following this, the malware will attempt to write a dummy file to the Windows directory, which would only be allowed with Admin privileges. If the creation of the file failed, it will sleep for a while and attempt the same another five times.

MITRE ATT&CK ... Virtualization/Sandbox Evasion T1497.001 ...

Ryuk utilizes a list of hardcoded strings to search for and stop specific running processes.

Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities... Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian... Clop has checked the keyboard language using the GetKeyboardLayout() function... Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage.

U.S. officials took down Ryuk’s money laundering operations... A Russian man pleaded guilty in 2023... to laundering funds for Ryuk... after he was accused of being a middleman for the group alongside 13 unnamed co-conspirators.

実際の攻撃事例でも、PsExecを利用しRyukを管理者権限で展開するケースが確認されています。

It was able to gain access via Remote Desktop Services or other direct methods

pingの応答があった端末が見つかった場合、該当端末の管理共有(C$等)にアクセスを試みます。管理共有にアクセスできた場合、配下の全てのファイルを暗号化していきます。

APT29 used scheduler and schtasks to create new tasks on remote hosts as part of lateral movement... Naikon has used schtasks.exe for lateral movement in compromised networks... RemoteCMD can execute commands remotely by creating a new schedule task on the remote system.

If it is, they download the Ryuk ransomware payload and use the admin credentials stolen using TrickBot to perform lateral movement and reach the assets they wish to infect.

FIN12 stages a ZIP archive with the filename share$.zip in the C:\PerfLogs directory on a domain controller.

MITRE ATT&CK ... Archive Collected Data T1560 ...

Latest commit yt0ng [[URL_1458811f_73]] added ryuk cobaltstrike c2s [[URL_1458811f_74]] Oct 29, 2020

EMOTET has been adapted as an early-stage implant used to load other malware families, such as QAKBOT, TRICKBOT, and RYUK... EMOTET downloads submodules to perform specific tasks.

Eventually, TrickBot is known to open a reverse shell back to the Ryuk Ransomware actors so that they can encrypt the entire compromised network.

MITRE ATT&CK ... Encrypted Channel T1573

The below graph shows that ransomware funds moved to Zhdanova’s wallet via a counterparty, after which she transferred millions of dollars to deposit addresses at mainstream exchanges and OFAC- and OFSI-sanctioned Russian Exchange, Garantex.

The widespread primary motive of both these campaigns appear to be to the exfiltration of sensitive information... Exfiltrate design, supply chain information, sensitive information, Personally Identifiable Information (PII), Customer Identifiable Information (CII)

ransomware operators are known to steal data before encrypting files

Actors have used privately developed ransomware, such as Maui and H0lyGh0st [T1486]. Actors have also been observed using or possessing publically available tools for encryption.

Ryukは暗号化処理と並行した別スレッドで、セキュリティ製品やバックアップソリューションに関わるサービスやプロセスを強制終了します。

また旧Ryukにおいては、以下のようにC:¥Users¥Public¥フォルダ内にバッチファイルを作成し、フォレンジックや復旧活動を妨害する処理をコマンドとして最後に一斉実行する挙動も確認しています。

By late Friday, the attack was hindering the transmission of pages from offices across Southern California to printing presses as publication deadlines approached.

The attacks encrypted victims’ data and demanded Bitcoin payments in exchange for decryption keys.