Loading malware…
Midas is a Windows ransomware family that emerged in 2021 and is widely assessed as a Thanos-derived variant built from the leaked Thanos ransomware builder. It is written in C# on the .NET framework and has been observed using SmartAssembly obfuscation. Midas is associated with double-extortion operations in which attackers steal data and threaten public release in addition to encrypting victim systems. It appends an extension based on the targeted organization’s name and typically drops HTA and text ransom notes.
Technically, Midas encrypts files with Salsa20 and protects the symmetric key with RSA public-key encryption. It has been observed terminating processes and services associated with security tools, databases, backup software, and office applications to maximize encryption coverage and reduce interference. It also deletes shadow copies to inhibit recovery and can establish persistence by creating a startup shortcut to reopen the ransom note after reboot.
Intrusions culminating in Midas deployment have relied heavily on hands-on-keyboard tradecraft and legitimate administrative tooling rather than a single distinctive malware delivery chain. Documented attacks involved prolonged dwell time, extensive use of PowerShell, internal RDP, malicious service creation, DLL sideloading through DISM, reflective loading, credential theft with Mimikatz, use of commercial remote access tools, and attempts to disable endpoint protections with Process Hacker before ransomware execution. In at least one investigated case, attackers leveraged administrator-level access to a domain controller, moved laterally across a flat Windows server environment, exfiltrated data, and then deployed ransomware gradually across servers. Midas has been linked to campaigns against enterprise environments, including a technology-sector victim, and operational overlaps have been noted with other Thanos-derived brands such as Haron, Prometheus, and Spook.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
It remains unknown how the attackers initially accessed the domain controller, or how they had compromised and taken control over the Administrator account on that machine. But once they had, the attackers leveraged the permissions from that account.
made extensive use of vulnerable remote access services
MITRE ATT&CK Technique ID Technique T1059 Command and Scripting Interpreter
a new, bare-bones ransomware that offloads most of its functionality to a series of PowerShell scripts
For instance, a PowerShell script would execute a Batch file, that in turn would launch a PowerShell script.
They also orchestrated parts of the attack using Visual Basic Script and Batch files, executed using the DISM.exe utility.
MITRE ATT&CK Technique ID Technique T1569.002 Service Execution
It remains unknown how the attackers initially accessed the domain controller, or how they had compromised and taken control over the Administrator account on that machine. But once they had, the attackers leveraged the permissions from that account.
MITRE ATT&CK Technique ID Technique T1112 Modify Registry
made extensive use of vulnerable remote access services
The attack involved repeated iterations of the threat actors creating Windows services designed to execute, on one machine at a time, several PowerShell scripts the attackers had placed on a few of the other compromised servers.
It remains unknown how the attackers initially accessed the domain controller, or how they had compromised and taken control over the Administrator account on that machine. But once they had, the attackers leveraged the permissions from that account.
The attack involved repeated iterations of the threat actors creating Windows services designed to execute, on one machine at a time, several PowerShell scripts the attackers had placed on a few of the other compromised servers.
An example of the heavily obfuscated PowerShell scripts the attackers ran on several machines over the course of many weeks. The scripts use layers of obfuscation that self-expand when executed.
It remains unknown how the attackers initially accessed the domain controller, or how they had compromised and taken control over the Administrator account on that machine. But once they had, the attackers leveraged the permissions from that account.
MITRE ATT&CK Technique ID Technique T1112 Modify Registry
MITRE ATT&CK Technique ID Technique T1562.001 Disable or Modify Tools
MITRE ATT&CK Technique ID Technique T1010 Application Window Discovery
MITRE ATT&CK Technique ID Technique T1057 Process Discovery
MITRE ATT&CK Technique ID Technique T1083 File and Directory Discovery
MITRE ATT&CK Technique ID Technique T1518.001 Security Software Discovery
They executed commands, launched internal RDP connections, took advantage of already-installed commercial remote access software, exfiltrated data to the cloud, and moved files to and from one of the target’s domain controllers over a two month period.
The earliest indicator of compromise took place on October 13, when logs on one of the compromised domain controllers indicate that a Remote Desktop Protocol (RDP) connection took place between a machine on the internal network of the targeted organization and the domain controller.
The attackers had placed on a few of the other compromised servers, which any other machine — VM or server — could just browse to over SMB.
A few minutes later, the attackers moved copies of two ransomware binaries, named <target>local.exe and <target>share.exe ... to an internal server and executed it.
During the first week the attackers were connected to the network, they were uploading various PowerShell scripts into the TEMP directory of some of the machines they controlled.
They executed commands, launched internal RDP connections, took advantage of already-installed commercial remote access software, exfiltrated data to the cloud.
late at night of December 7 in the target’s time zone, the attackers began deploying the ransomware binary to machines on the target’s network.
We also recovered PowerShell scripting commands that the attackers used in an attempt to shut down 46 processes, and 216 services, by name.
MITRE ATT&CK Technique ID Technique T1490 Inhibit System Recovery
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.