virus logo Threat Signal Report

Conti Ransomware Operational Procedures and Associated Files Leaked to Web

Description

FortiGuard Labs is aware of reports of the disclosure of operational documents and procedures relating to the Conti ransomware group. Apparently, a disgruntled self-proclaimed pentester of the Conti group has leaked this information to the public for reasons unknown at this time. Contained within this leak are zipped password protected files, operational "how to" documents, and other information created by the group for its affiliates.

Conti, in operation for over a year, is Ransomware as a Service (RaaS) and has been connected to multiple attacks in the past, with the most recent high profile attack on the Irish Health Service that caused a massive disruption to their services. In this attack, not only were services disrupted and brought to a halt, but database servers (SQL) and over 700GB of personally identifiable information (PII) was downloaded and exfiltrated by the threat actors.


What is Contained in this Leak?

Cursory analysis of the manual (machine translated from Russian) by FortiGuard Labs highlights the documented operational procedures of the Conti ransomware group written for affiliate use using the legitimate Cobalt Strike tool. In the introduction, it highlights that the threat actor or affiliates seek out targets/companies with verifiable income, by using publicly available data, such as Owler, Manta, Zoominfo, DNB, RocketReach, etc. It also provides working search engine queries to figure out company revenue, e.g. "site:xyz.com revenue" for further specifics. This is perhaps to gauge financial information for lesser well known entities and to most likely to see how much an organization is likely to pay.

Also provided is operational data for the affiliate once they have established a reverse shell or persistence with the victim's Windows Domain Controller. Instructions are included on how to list domain controllers, local and domain administrators, enterprise administrators, known domain computers, and ping all hosts on a known network. Once this traversal information has been established, instructions on how to deploy the payload is provided via PowerShell.

The document states that once the various containers are accessed, what should be looked for is:

  • Accounting
  • Clients
  • Financial documents
  • IT
  • Projects
Other observations include the usage of multiple pentesting tools (post exploitation), along with the usage of various open source tools designed to intercept and brute force passwords at the domain controller.

Kerberoast

The overview and usage of Kerberoast, which is an attack on domain controllers that tries to crack the hash of a Kerberos encrypted password via brute force. Once the hash is cracked, the password is then provided in clear text for an adversary to traverse further along an environment and to add accounts via compromised higher level admin accounts.

The document also mentions the ultimate goal is to get the admin password via further brute forcing.

MimiKatz

Simple overview of Mimikatz and useful command lines for the extraction of clear passwords from memory, Kerberos tickets, etc. Also highlights examples of combined MimiKatz/Cobalt Strike usage. Other instructions include guidance on pass-the-hash/NTLM, reading lsass, procdump and other post exploitation techniques.

SMBAutoBrute

The usage of an open source tool SMBAutoBrute. According to the Github page for this tool, it allows pentesters to perform smart brute forcing of accounts against the current domain, ensuring that lockouts do not occur. The document further explains to the reader to look for the parameter of

Lockout threshold: Never

Where "Never" is set, this means that no lockout of the account occurs after failed attempts.

Vulnerabilities

The usage of CVE-2020-1472 (privilege escalation in Netlogon) within Cobalt Strike. This allows an unauthenticated attacker with network access to compromise a domain controller Active Directory identity services.

Interestingly enough, #PrintNightmare is mentioned in this document which reveals to us that this document was either recently created or updated.


Operational Security Guidance

Operational guidance for remaining anonymous. Notes provided by the Conti Group highlight that it is important to remain anonymous, but it is not imperative to hide, as by disabling known services and technologies, you are bound to be detected even more. It is even advised by the threat actors to not utilize well known Linux pentesting operating systems, and either use generic ones or build your own is suggested.


What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage against known Conti ransomware samples campaign:


W32/Conti.I!tr

W64/Filecoder_Conti.A!tr

W64/Conti.A!tr.ransom

W32/Filecoder_Conti.D!tr

W32/Conti.R!tr.ransom

W32/Conti.HLCT!tr.ransom

W32/Filecoder_Conti.R!tr

W32/Conti.L!tr.ransom

W32/Conti.N!tr.ransom

W64/Conti.M!tr.ransom


FortiEDR detects and blocks Conti ransomware attacks out of the box without any prior knowledge or special configuration beforehand. This can be seen in the images below where the TTPs of the attackers are detected pre execution.


For more information on how FortiEDR blocks Conti, please refer to the following KB article for more details:


Any Other Suggested Mitigation?

As it has been observed that Conti affiliates have used AnyDesk, Atera, Splashtop, Remote Utilities and Screen Connect to initialize and maintain persistent network access, it is recommended to block all remote access connections from these programs by initializing application controls.


Due to the ease of disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.


It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine risk.


Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spear phishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spear phishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.

Appendix

Tweet by vx-undergound (Twitter)


ID 40
Date Aug 06, 2021
Threat/
Vulnerability		 Ransomware
FortiGate Device Triggered N/A
Threat Actor Type Unknown
Experienced a Breach? We're here to help FortiGuard Incident Response Services
FortiGuard Incident Response Services