Darkside

It chose targets based on a careful financial analysis or information gleaned from corporate emails.

Att&ck IDs: T1592 - Gather Victim Host Information

In Sophos’ experience in data forensics and incident response to DarkSide attacks, the initial access to the target’s network came primarily as a result of phished credentials.

In late March, DarkSide introduced a “call service” innovation that was integrated into the affiliate’s management panel, which enabled the affiliates to arrange calls pressuring victims into paying ransoms directly from the management panel.

Yes, a few weeks ago, we launched a balanced service of the calls to our victims, while we call only our customers, but soon we also want to put pressure on their partners.

A person familiar with the matter said on Monday that the server also carried data from other DarkSide ransomware operations in progress...

Att&ck IDs: T1587 - Develop Capabilities

T1588.001 Obtain Capabilities: Malware Various malware samples are used to distribute Zloader or are distributed by Zloader itself.

operators have gained entry through insecure remote access services using compromised credentials.

operators have gained entry through insecure remote access services using compromised credentials.

Может распространяться путём... эксплойтов

In some cases, DarkSide ransomware has also been delivered through compromised third-party service providers.

According to my visibility, at least one threat actor who used DarkSide adopted the phishing technique (T1566) in order to deliver a first-stage payload whose exploitation finally allowed the distribution of DarkSide variants within the victim environment.

the ransomware payload attempted to access the Windows Management Instrumentation (WMI) service.

Mandiant has observed the threat actor using PsExec and cron jobs to deploy the DARKSIDE ransomware

PowerShell to carry out objectives, such as to apply GPO to create a scheduled task to execute the ransomware.

DarkSide runs several ESXCLI commands ... in order to collect information about the infected ESXI host, such as the running virtual machines, storage-related information, and vSAN-related information.

Encrypted Powershell runs “delete shadow copy”

This payload was executed using rundll32, and a service was created to maintain persistence.

Attackers have exploited Palo Alto’s CVE-2019-1579 and Microsoft Exchange vulnerabilities to breach a target environment ... As a result of exploitation, an unauthenticated attacker could execute malicious code remotely (RCE).

Может распространяться... с помощью email-спама и вредоносных вложений, обманных загрузок... фальшивых обновлений, перепакованных и заражённых инсталляторов.

PsExec, a remote administration tool, was seen running the main malware payload (.exe).

setting the registry value HKCU\Software\Classes\exefile\shell\open\command\Default to the malware path and executing slui.exe

Mandiant has observed the threat actor using PsExec and cron jobs to deploy the DARKSIDE ransomware

PowerShell to carry out objectives, such as to apply GPO to create a scheduled task to execute the ransomware.

operators have gained entry through insecure remote access services using compromised credentials.

A new registry key called <RansomPseudoValue> is created... The DefaultIcon subkey is created... The “WallPaper” value inside the registry key is changed to the location of the newly created BMP file.

operators have gained entry through insecure remote access services using compromised credentials.

Service Enumeration and Delete Enumerate and compare with these services, vss,sql,svc$,memtas,mepocs,sophos,veeam,backup If found then delete the service.

"This involves setting the registry value HKCU\Software\Classes\exefile\shell\open\command\Default to the malware path and executing slui.exe"

Mandiant has observed the threat actor using PsExec and cron jobs to deploy the DARKSIDE ransomware

PowerShell to carry out objectives, such as to apply GPO to create a scheduled task to execute the ransomware.

On execution, the malware copies itself to the path “C:\Users\admin\AppData\Local\Temp\” and injects its code into the existing process

The malware attempts a UAC bypass that uses the CMSTPLUA COM interface... it will relaunch the malware with SYSTEM privileges.

operators have gained entry through insecure remote access services using compromised credentials.

Get access token from admin process (e.g. Explorer.exe)

As the ransomware was found to be distributed using the AD group policy, AhnLab attempted to conduct a DC server forensic analysis.

Service Enumeration and Delete Enumerate and compare with these services, vss,sql,svc$,memtas,mepocs,sophos,veeam,backup If found then delete the service.

"This involves setting the registry value HKCU\Software\Classes\exefile\shell\open\command\Default to the malware path and executing slui.exe"

BlackMatter also attempts to elevate its privileges when it is limited by User Account Control (UAC). It does so via an elevated COM interface

The malware attempts a UAC bypass that uses the CMSTPLUA COM interface... The file executes CoGetObject with the object name as Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}.

"If the OS version is Windows 10 or newer, the malware attempts a UAC bypass that uses the CMSTPLUA COM interface"

Stealth tactics include: ... Obfuscation techniques like encoding and dynamic library loading

To avoid detection by AV and EDR solutions, the ransomware dynamically loads its libraries, without registering them in its imports section

This approach won’t work for strings, as they’re decrypted on an ad-hoc basis just before being used, rather than in a single place.

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

On execution, the malware copies itself to the path “C:\Users\admin\AppData\Local\Temp\” and injects its code into the existing process

Flags — enable/disable the following features ... Delete volume shadow copies ... Empty Recycle Bin ... Self-delete

All files and directories from Recycle Bin are deleted by the process... the files are deleted using the DeleteFileW function, and the directories are removed using the RemoveDirectoryW routine.

operators have gained entry through insecure remote access services using compromised credentials.

Get access token from admin process (e.g. Explorer.exe)

"The remaining bytes... are aPLib-decompressed into the allocated buffer. The decompressed bytes include the ransom note and other elements of the malware's configuration"

Once inside the network, attackers used known techniques for increasing access and compromising the network, including Living-off-the-Land Binaries (LOLbins) and offensive security tools such as Cobalt Strike, Mimikatz and others.

The malware creates a mutex called “Global\4787658f1cc4202b8a15e05dd0323fde”, which makes sure that there is only one instance of the ransomware running at a time.

By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.

Использует пару методов для проверки принадлежности ПК к некоторым странам СНГ (проверяет GetSystemDefaultUILanguage - язык системы, GetUserDefaultLangID - язык пользователя по умолчанию).

setting the registry value HKCU\Software\Classes\exefile\shell\open\command\Default to the malware path and executing slui.exe

A new registry key called <RansomPseudoValue> is created... The DefaultIcon subkey is created... The “WallPaper” value inside the registry key is changed to the location of the newly created BMP file.

As the ransomware was found to be distributed using the AD group policy, AhnLab attempted to conduct a DC server forensic analysis.

MITRE ATT&CK T1553.004 Subvert Trust Controls: Install Root Certificate

The attackers... make an effort to terminate software that, if it was running, might otherwise interfere with the encryption process... They also attempt to uninstall or tamper with Sophos services if they’re present on the machine.

Once inside the network, attackers used known techniques for increasing access and compromising the network, including Living-off-the-Land Binaries (LOLbins) and offensive security tools such as Cobalt Strike, Mimikatz and others.

the configuration field like “credentials” is also used by BlackMatter V1 and Darkside. In this field, it includes the victim’s domain credentials.

it then proceeds to terminate various database, office applications, and mail clients to prepare the machine for encryption.

MITRE ATT&CK T1012 Query Registry

To accomplish this, it first attempts to look for domain controllers.

Retrieve the domain controllers and probably an attempt to spread further... It calls functions such as DsGetDcNameW, DsGetDcOpenW and DsGetDcNextW.

The ransomware retrieves the username associated with the current thread, as well as the NetBIOS name of the local machine.

Windows [ ... arp scanner, ... ]

They emphasized their speed of encryption and a wealth of options for dealing with anything that may inhibit the encryption process (i.e., security software). ... process termination, service termination

Researchers said the malware “parses its embedded configuration, kills virtual machines, encrypts files on the infected machine, collects system information, and sends it to the remote server.”

It loops across the files on the root path mentioned in the embedded configuration or in the given parameter.

MITRE ATT&CK T1120 Peripheral Device Discovery

Darkside enumerates all network shares using the NetShareEnum API and encrypts each one of them by the main encryption routine described so far.

For this phase, DarkSide abuses various tools, namely PowerShell, Metasploit Framework, Mimikatz, and BloodHound... DarkSide aims to gain Domain Controller or Active Directory access.

By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.

Использует пару методов для проверки принадлежности ПК к некоторым странам СНГ (проверяет GetSystemDefaultUILanguage - язык системы, GetUserDefaultLangID - язык пользователя по умолчанию).

In the past few years, ransomware hackers have found an almost perfect solution — cryptocurrencies like Bitcoin. It's fast. It's easy. Best of all, it's largely anonymous and hard to trace.

DarkSide could be considered one such "privateer" group. This ransomware family... checks the target's keyboard configuration to avoid any user whose keyboard is in the Cyrillic language.

Once a foothold is established, the Cobalt Strike red teaming tool is used to spread and deploy DarkSide ransomware.

Early on in the deployment process, the threat actor leveraged RDP to interactively execute DarkSide on a limited number systems in the environment.

PsExec, a remote administration tool, was seen running the main malware payload (.exe). The ransomware payload (.dll) was hosted on a shared folder

Using PSExec, Remote Desktop connections, and (in the case of Linux servers) SSH to move laterally within the network...

Once a foothold is established, the Cobalt Strike red teaming tool is used to spread and deploy DarkSide ransomware.

MITRE ATT&CK T1005 Data from Local System

First of all we have uploaded more then 100 GB data... The data is preloaded and will be automatically published if you do not pay.

"0x15 Yes Create a mutex" and decrypted string "Global\XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

It chose targets based on a careful financial analysis or information gleaned from corporate emails.

The data from above is encrypted by a custom encryption algorithm... The result of the encryption operation is base64-encoded.

Figure 17 shows the HTTP POST request sent by the malware to the remote server with the collected information.

Internet connection securebestapp20[.]com/<URL Path Generator>

After the encryption phase, Darkside is designed to communicate to its command and control server... In the analyzed sample, the CnC (Command and Control) is attested over the domain name securebestapp20.com.

To remain anonymous and prevent prompt shutdown, websites for contacting ransomware threat actors are hosted in the Tor network.

DarkSide stands out from other ransomware as a service (RaaS) threats, as one of the attack vectors is based on the Zloader botnet (also known as “Silent Night”) ... Zloader is a first-stage Trojan loader.

Использует сеть Tor для сайта и публикации там же украденной информации компаний-жертв.

Added the field "AES_KEY" with the AES key used to cipher the victim info to send to the C2.

All your data will be replicated between multiple servers, blocking one server won't delete data.

This ransomware group follows the double extortion tactic – meaning not only do they encrypt the user’s data, but also exfiltrate it and threaten to make it public in case the ransom demand is not met.

While they spread laterally, the attackers will harvest unencrypted data from the victim's servers and upload it to their own devices.

Darkside operates using a Ransomware-as-a-Service (Raas) model and utilizes the double extortion technique (data encryption, data theft and leak).

REvil (Sodinokibi) threat actors listed this attack as their work, and claim to have more than 175 GB of data: We downloaded a lot of interesting information from your network.

Using PSExec, Remote Desktop connections, and (in the case of Linux servers) SSH to move laterally within the network, the DarkSide actors uploaded archives of stolen files to the cloud storage providers Mega or pCloud in cases we’ve investigated.

the threat actors also created a private data leak page with a description of the types of stolen data and screenshots of some of the files.

Your computers and servers are encrypted, backups are deleted.

“Successful data encryption also rose to 56 per cent of attacks” and recovery requires restoring data and systems after ransomware encrypts them.

The latest version of DarkSide attempts to stop the same list of backup and anti-malware services as previous versions targeted | DarkSide kills processes that contain the following strings in their names to unlock the files

The binary uses COM objects and WMI commands to delete volume shadow copies... it deletes each of the shadow copy objects via the DeleteInstance method. | Offset 0x06 Yes Delete volume shadow copies... The process executes the following SQL query “SELECT * FROM Win32_ShadowCopy” ... and then it deletes each of the shadow copy objects via the DeleteInstance method.

The process reveals a message that will be utilized to set a custom wallpaper that contains important instructions for the victim.

After the encryption routine runs, a bitmap image file is created in the path C:\ProgramData with the same name as the encryption extension... The following registry keys are created that generate a ransom note wallpaper on the user’s desktop

Triple extortion follows a straightforward formula: adding DDoS attacks to the aforementioned encryption and data exposure threats.

If a process name contains any of the following strings, it will be killed by the binary... For every targeted process, the binary opens the process and terminates it and all of its threads.

Darkside operates a leak site, where stolen data is posted to further increase pressure on victims.