Threat Signal Report

Yanluowang Ransomware Used By a Threat Actor Previously Linked to Thieflock Ransomware

description-logo Description

FortiGuard Labs is aware of a report that Yanluowang ransomware was recently used by a threat actor who previously employed Thieflock ransomware. According to Symantec, the threat actor focuses on organizations across multiple sectors in the United States. Yanluowang ransomware was first reported in October 2021. Yanluowang attackers demand ransomware from the victims and tell them not to contact law enforcement or ransomware negotiation firms. If they do, the attackers threaten the victim with distributed denial of service (DDoS) attacks as well as making phone calls to alert the victim's business partners.


Why is this Significant?

This is significant because the attacker, who mainly targets U.S. corporations, appears to have switched their arsenal from Thieflock ransomware to Yanluowang ransomware. Because of this, companies in the United States need to pay extra attention to the tools, tactics, and procedure (TTPs) that this attacker uses.


What TTPs is the Attacker Known to Use?

According to the report, the attacker uses the following tools:

  • GrabFF: A tool to dump passwords from Firefox
  • GrabChrome: A tool to dump passwords from Chrome
  • BrowserPassView: A tool to dump passwords from Web browsers such as Internet Explorer, Chrome, Safari, Firefox, and Opera
  • KeeThief: A PowerShell script to copy the master key from KeePass
  • Customized versions of Secretsdump: Security Account Manager (SAM) credential-dumping tools
  • FileGrab: A tool to capture newly created files in Windows file systems
  • Cobalt Strike Beacon: A tool that allows the attacker to perform command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement.
  • ProxifierPE: A tool to proxy connections back to attacker's Command and Control server (C&C)
  • ConnectWise: A remote desktop software that provides remote access to the attacker
  • AdFind: A command-line Active Directory query tool
  • SoftPerfect Network Scanner: A tool to discover hostnames and network services
  • BazarLoader: A backdoor program that is used to deploy additional malware and steal confidential information from the compromised machine. The attacker typically downloads BazarLoader using PowerShell.

The initial attack vector is unclear so suspicious emails must be handled with caution and the patches for products and software that are used in the company must be applied.


What is Yanluowang Ransomware?

Yanluowang ransomware is reported to perform the following actions:

  • Terminates all hypervisor virtual machines (VMs) running on the compromised machine
  • Terminates processes, such as SQL and back-up solution Veeam, that are listed in processes.txt
  • Encrypts files on the victim's machine and appends the .yanluowang extension to them
  • Drops a ransom note

In the ransom note, Yanluowang attacker asks the victim to follow their rules including not to contact law enforcement or ransomware negotiation companies or else the attacker will launch distributed denial of service (DDoS) attacks against the victim and will make phone calls to the victim's employees and business partners.


What is the Status of Protection?

FortiGuard Labs provides the following AV coverage against Yanluowang ransomware:

W32/Ylwransom.A!tr.ransom

All network IOCs are blocked by the WebFiltering client.

Appendix

Yanluowang: Further Insights on New Ransomware Threat (Symantec)


Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.		 Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.		 Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.		 Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.		 Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.