Loading malware…
RansomEXX is an enterprise-targeting ransomware family derived from Defray777, which emerged in 2018 and was rebranded as RansomEXX in June 2020. It targets Windows and Linux systems, including VMware ESXi environments, where encryption of centralized virtual-machine storage can disrupt multiple workloads. Its operators target large organizations across government, technology, manufacturing, telecommunications, healthcare, and other sectors. The financially motivated threat group GOLD DUPONT distributes RansomEXX, and the ransomware affiliate Bassterlord has also been associated with the operation.
RansomEXX campaigns use phishing, exposed or vulnerable remote-access services, and compromised accounts to gain access. TrickBot has also been used to deliver the ransomware. Operators employ Cobalt Strike, Mimikatz, and legitimate administrative tools to support credential theft, privilege escalation, and lateral movement before deploying the encryptor. The operation uses double extortion, stealing sensitive information before encryption and threatening publication to pressure victims into paying.
Analyzed RansomEXX variants use AES-256 for file encryption and RSA to protect encryption keys. Earlier implementations use AES-256 in ECB mode with an embedded RSA-4096 public key. Payloads are customized with victim-specific encrypted-file extensions and ransom notes. Windows variants delete shadow copies and backups, disable recovery functions, clear event logs, and terminate security, database, and other application processes. The family has also evolved from C++ implementations to Rust-based variants.
An analyzed Linux encryptor fails to lock files during encryption. Concurrent writes can append plaintext after the RSA-encrypted key stored at the end of an encrypted file, causing the attacker-supplied decryptor to fail. Profero released an alternative decryptor that accommodates this condition, but recovery still requires the corresponding decryption key; it does not provide keyless decryption.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
RansomEXX v2.0 is a sophisticated variant of the RansomEXX ransomware, known for targeting large organizations and demanding significant ransom payments.
Later in 2023, the same organization was targeted by the GOLD DUPONT threat group, which distributes the RansomExx ransomware.
Bassterlord, a suspected Russian-speaking threat actor who previously served as an affiliate for the LockBit ransomware gang, but also other rival RaaS operations, such as REvil, Avaddon, and RansomExx.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
A November 2020 technical analysis of Pyxie RAT, a remote access trojan that often precedes Defray777/RansomEXX ransomware infections, identified several keyword searches on a victim’s network indicating an interest in the victim’s current and near future stock share price.
Similar to other ransomware operations, RansomEXX will breach a network using vulnerabilities or stolen credentials.
...обманных загрузок... вредоносной рекламы, веб-инжектов, фальшивых обновлений...
...эксплойтов...
...с помощью email-спама и вредоносных вложений...
“flagged as a phishing email with an attached password-protected ZIP file, which is actually a Word document … with a malicious macro… lures users into enabling macro content”
Using Windows services to execute the ransomware payload.
Similar to other ransomware operations, RansomEXX will breach a network using vulnerabilities or stolen credentials.
Модифицирует следующие ключи реестра: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableConfig ... DisableSR
Similar to other ransomware operations, RansomEXX will breach a network using vulnerabilities or stolen credentials.
The AES key is encrypted by a public RSA-4096 key embedded in the Trojan’s body and appended to each encrypted file.
cipher.exe - инструмент для стирания свободного места на диске, чтобы с помощью программ для восстановления данных нельзя было ничего вернуть
Similar to other ransomware operations, RansomEXX will breach a network using vulnerabilities or stolen credentials.
Модифицирует следующие ключи реестра: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableConfig ... DisableSR
Отключает восстановление системы... Завершает 289 процессов, связанных с защитным ПО, серверами баз данных, программным обеспечением MSP, инструментами удаленного доступа и почтовыми серверами.
Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits.
...очищает журналы Windows ( Application, System, Setup, Security ), используя команды: wevtutil.exe cl Application ... wevtutil.exe cl Security
Cybercriminals employ the features of Mimikatz for credential dumping to extract usernames, passwords, and other credentials that might be used to escalate privilege in other phases of the attack.
Like other ransomware gangs, RansomEXX will compromise a network through purchased credentials, brute-forced RDP servers, or by utilizing exploits.
Может распространяться путём взлома через незащищенную конфигурацию RDP...
Like other ransomware gangs, RansomEXX will compromise a network through purchased credentials, brute-forced RDP servers, or by utilizing exploits.
Using SMB shares to move laterally and deploy ransomware payloads.
The victims were industrial companies in Southeast Asia. To penetrate the infrastructure, the attackers exploited the CVE-2017-0144 vulnerability.
Like other human-operated ransomware operations, RansomExx will compromise a network and begin harvesting unencrypted files for their extortion attempts.
...перепакованных и заражённых инсталляторов.
When RansomExx encrypts a file, it will append an RSA encrypted decryption key to the end of each encrypted file. If a victim pays a ransom, the threat actor supplies a decryptor that can decrypt each file's encrypted decryption key and then use it to decrypt the file's contents.
RansomExx does not have a ransomware data leak site, but that does not mean they do not steal unencrypted files before deploying their ransomware.
Once the threat actors gain access to a network, they quietly spread through the network while stealing unencrypted files for extortion attempts.
Targets critical files and backups, rendering them inaccessible.
Stopping services to facilitate encryption and hinder recovery efforts.
Deleting or disabling backup and recovery systems.
40 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.