Threat Signal ReportLockBit 2.0 Ransomware as a Service (RaaS) Incorporates Enhanced Delivery Mechanism via Group Policy
Description
FortiGuard Labs is aware of a new variant of the LockBit ransomware, specifically version 2.0. LockBit 2.0 is ransomware as a service (RaaS). The latest variant of LockBit has an enhanced propagation component unseen before in ransomware. The latest development discovered by security researchers @MalwareHunterTeam and @VitaliKremez was reported by security news outlet Bleeping Computer that the ransomware component will automatically distribute itself throughout a domain. Affiliates of LockBit typically earn approximately 70-80% of earnings, while the authors earn the rest.
What are the Technical Details?
When the ransomware is executed on a victim's system, specifically on a compromised domain controller controlled by an attacker, the threat actor is able to deploy group policies to all machines connected to the domain. The newly deployed group policies then disable Windows Defender real time protection and various other alert and reporting mechanisms on the victim machine. The ransomware will then perform queries to see which machines are listed and from this list, the ransomware will be copied to all computers. Then a scheduled task which was preconfigured by the malicious group policy will launch the malware via a UAC bypass, which runs in the background without notification to the end user.
What Operating Systems are Affected?
Windows Operating Systems.
How Widespread is this Attack?
Details are limited on spread at this time.
What is the status of AV and IPS coverage?
FortiGuard Labs has AV coverage for known publicly available samples as:
W32/Lockbit.C2F8!tr.ransom
Any Other Suggested Mitigation?
Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.
Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.
