Researchers Uncover Series of Ransomware Attacks that Follow Same Pattern

Ransomware groups often recycle tools, techniques, and procedures. Even some of them also provide playbooks for affiliates as well.

Numerous use Cobalt Strike for remote access, employ RDP brute force, and target Domain Controller servers to control network machines.

Cybersecurity researchers at Sophos X-Ops recently reported their investigation on ransomware attacks from Jan 2023 publicly, under which they examined four ransomware attacks.

They investigated the following attacks:-

• One attack by Hive
• Two attacks by the Royal
• One attack by Black Basta

In these attacks, the most shocking thing that researchers unveiled publicly is they found several similarities in the attack pattern of these ransomware groups.

Patterns of Behavior

Here below we have mentioned all the patterns of behavior that are observed by the security analysts at Sophos MDR:-

• Attackers crafted admin accounts on hijacked Domain Controller servers with non-random, unique usernames and complex passwords.
• Applied steady tool persistence methods using identical names.
• Utilized matching pre-deployment batch scripts to set up ransomware.
• The final ransomware payload is deployed via a .7z archive named after the targeted organization. Here with the same password, the .7z archive is password-protected and executed with a matching shell command.

Ransomware Attacks that Follow the Same Pattern

What caught Sophos MDR’s attention was the inclusion of Royal ransomware in the attack cluster, a group known for exclusivity, avoiding outside “affiliate” attackers.

A cluster doesn’t guarantee attribution, but in some scenarios, it could do the same with strong evidence. Shared behaviors don’t confirm the same attackers, but suggest a similar playbook, as Kroll Inc. analysis shows a fifth attack aligns with this cluster.

Here below we have mentioned the same batch scripts and files that are used:-

• file1.bat
• file2.bat
• ip.txt
• gp.bat

Threat actors use the Scheduled Tasks for the creation of persistence methods, and they name the tasks with the following types of names:-

• Microsoft Update
• Windows Update
• Windows Update 1
• Windows Update 2
• Windows Sensor qe
• Windows Sensor qe 1

Common Tools & Techniques

Common tools and techniques used:-

• Network reconnaissance using Advanced Port Scanner
• Extensive use of PowerShell commands converted into base64 strings
• Installation of a secondary backup remote access with Cobalt Strike
• Use of commercial tools like TeamViewer, WizTree, or Citrix Enterprise Browser
• Lateral movement via Remote Desktop
• Dumping the NTDS and Registry hive for credential extraction
• Use of dual-use tools like PsExec
• Payloads hosted on public services like Pastebin
• Use of rclone to move off the system
• For final protection evasion, threat actors reboot the systems into Safe Mode.

Logs from the Hive ransomware attack earlier this year against a target with a different endpoint security product revealed the first signs of the threat cluster behavior.