Threat Signal Report

New Variant of Phobos Ransomware Hitting the Wild

description-logo Description

FortiGuard Labs is aware that a new variant of Phobos ransomware is hitting the wild. Phobos ransomware is thought to have a close relationship to the CrySIS and Dharma ransomware families. Phobos ransomware encrypts files with predetermined file extensions and deletes shadow copies and the backup catalog to prevent the easy restoration of the files.


Why is this Significant?

This is significant because Phobos is an older ransomware that has been around since at least late 2017 and has been updated several times since. The newly observed variant provides a proof that Phobos is still actively developed and used.


What is Phobos Ransomware?

Phobos is a ransomware that is thought to be closely related to the CrySIS and Dharma ransomware families and generally targets small to medium-sized businesses. There is not much notable about the ransomware as it encrypts files with predetermined file extensions and deletes shadow copies and the backup catalog to prevent the easy restoration of the files. This particular Phobos ransomware variant adds "[(removed)@imap.cc].XIII.XIII" file extension to the files it encrypts and demands ransom to decrypt the affected files.


How does Phobos Ransomware Arrive?

Phobos ransomware is delivered either via malicious attachments in emails or through vulnerable Remote Desktop Protocol (RDP) connections.


What is the Status of Coverage?

FortiGuard Labs provides AV coverage against this new variant of Phobos ransomware as W32/Generic.AP.34AB98!tr.


FortiGuard Labs provides the following AV protection against other known variants of Phobos ransomware:


W32/Phobos.A!tr.ransom

W32/Phobos.B!tr

W32/Filecoder_Phobos.A!tr

W32/Filecoder_Phobos.A!tr.ransom

W32/Filecoder_Phobos.B!tr

W32/Phobos.B!tr.ransom

W32/Phobos.C!tr

W32/Phobos.C!tr.ransom

W32/Filecoder_Phobos.E!tr.ransom

W32/Phobos.E!tr.ransom

W32/Phobos.F!tr.ransom

W32/Filecoder_Phobos.C!tr

W32/Phobos.HGAF!tr.ransom

W32/Phobos.B828!tr.ransom

W32/Phobos.B936!tr.ransom

W32/Filecoder_Phobos.E!tr

W32/Phobos.3257!tr.ransom

W32/Phobos.8B03!tr.ransom

W32/Filecoder_Phobos.C!tr.ransom

W32/PhobosRansom.190E!tr.ransom

Riskware/Filecoder_Phobos


Any Other Suggested Mitigation?

Due to the ease of disruption and the potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.


Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.

Appendix

Tweet by PCrisk


Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.