Threat Signal Report

Ransomware Roundup – 2022/06/09

description-logo Description

FortiGuard Labs has become aware of several ransomware that caught public attention for the week of June 6th, 2022. It is imperative to raise awareness about ransomware variants because infections can cause severe damage to organizations. This week's Ransomware Roundup Threat Signal covers YourCyanide, LockBit, WhiteCat, and DeadBolt ransomware along with the Fortinet protections against them.



What is YourCyanide ransomware?

YourCyanide ransomware is a CMD-based ransomware variant still under development and abuses PasteBin, Discord, Telegram and Google services. The ransomware belongs to GonnaCope ransomware family that was discovered in April 2022.


YourCyanide ransomware reportedly arrives as an LNK (Link) file that contains a PowerShell script that downloads and runs a malicious file from Discord. The downloaded file then drops and executes a CMD file. The CMD file downloads another CMD file from Pastebin, which performs several activities that include:


  • Checks for usernames for which the ransomware avoids infection.
  • Drops a Batch file that continues to open the Blank Screen Saver file
  • Checks for specific services and security applications which the ransomware tries to terminate
  • Swaps the mouse button
  • Disables TaskManager
  • Ranames files in Desktop, Documents, Music, Pictures, Videos, and Downloads folders. Renamed files have a ".cyn" file extension
  • Creates two VBS files that send the ransomware as an email attachment
  • Copies itself to D, E, F, G, and H drivers as well as UserProfile folder
  • Drops a ransom note to Desktop
  • Downloads a remote CMD file from Discord


The CMD file downloaded from Discord steals access token from applications including Chrome, Discord, and Microsoft Edge, and collects information such as installed applications, and machine information from the compromised machine. The collected information will be then sent to a Telegram chat bot.


It also reportedly downloads an executable file from Google Docs and executes it. The remote executable file is no longer accessible, however the file is likely used to steal credentials from various Web browsers.



Screenshot of YourCyanide's ransom note


What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage against available samples associated with YourCyanide ransomware:


BAT/Agent.QU!tr.dldr

BAT/Agent.C20D!tr

LNK/Agent.AG!tr.dldr

LNK/Agent.3D7B!tr.dldr

PossibleThreat




What is LockBit ransomware?

LockBit is a ransomware that encrypts files in victims' machines and exfiltrate data. It then demands ransom in exchange for decrypting the affected files and not releasing the stolen data to the public. LockBit functions as Ransomware-as-a-Service (RaaS) that has been active for years and provides Lockbit ransomware, operates data leaks and ransom payment sites, and offers ransom negotiation service to its affiliate. Affiliates of LockBit typically earn approximately 70-80% of earnings, while the LockBit operators earn the rest.


LockBit ransomware recently came to light again this week because Evil Corp reportedly switched their ransomware to LockBit in order to avoid sanctions imposed by the U.S. government. Evil Corp is a threat actor group that is known to have developed and use Dridex banking malware for financial gain. Dridex was also used to deliver another malware such as ransomware to victims' machines. Alleged ransomware that were previously associated with Evil Corp includes Bitpaymer, Doppelpaymer, Wastedlocker and Hades.


FortiGuard Labs previously released a Threat Signal on LockBit. See the Appendix for a link to "LockBit 2.0 Ransomware as a Service (RaaS) Incorporates Enhanced Delivery Mechanism via Group Policy".


What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage against recent Lockbit ransomware samples:


W32/LockBit.29EA!tr.ransom

W32/Generic.AC.171!tr

MSIL/Generic.EBMY!tr

W32/Filecoder.NXQ!tr.ransom

W32/Filecoder.OAN!tr.ransom



What is WhiteCat ransomware?

WhiteCat is a new Chaos ransomware variant. It checks for "forbidden country" by looking at the current input language/keyboard. If the current inpur/keyboard is set to "az-Latn-AZ" (Latin, Azerbaijani) and "tr-TR" (Turkish), the ransomware stops infection. The ransomware then searches for files smaller than 2,117,152 bytes on the compromised machine and encrypts them. It also overwrites files larger than 2,117,152 bytes on the compromised machine. The affected files will have a random 4 letter file extension. Lastly, WhiteCat drops and displays a ransom note in READMEPLEASE.txt.



Screenshot of WhiteCat's ransom note


What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage against WhiteCat ransomware:

MSIL/ClipBanker.SX!tr



What is DeadBolt ransomware?

DeadBolt ransomware is a new ransomware that was first discovered in early 2022 and targeted QNAP Network-Attached Storage (NAS) devices for file encryption. It has since evolved to infect Asustor NAS devices. NAS devices are often used by SOHO (Small Office/Home Office) and home users for backup and file sharing purposes. QNAP released a security advisory on May 19th, warning its users of the ransomware. The advisory also urges the users to apply the latest update to the NAS devices or remove them from internet, which is an indication that DeadBolt ransomware was seen to exploit an unspecified QNAP vulnerability.


Files encrypted by DeadBolt ransomware typically have a ".deadbolt" file extension. Its ransom note is "ALL YOUR FILES HAVE BEEN LOCKED BY DEADBOLT.html" and demands ransom from the victim to obtain a decryption key for the affected files. What's curious about DeadBolt's ransom note is that it includes a link to another ransomware directed at QNAP and Asustor. The ransom note for QNAP states that the company will receive information on the QNAP vulnerability that DeadBolt exploited to infect QNAP devices in exchange for Bitcoin payment. If the company pays extra ransom, QNAP will receive the vulnerability information as well as master decryption key that can decrypt all files encrypted by DeadBolt ransomware.



Screenshot of DeadBolt's ransom note courtesy of Asustor


What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage against DeadBolt ransomware:

Linux/Filecoder_DeadBolt.A!tr

Linux/Filecoder_DeadBolt.B!tr


Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.