Sandworm gang launches Monster ransomware attacks on Ukraine
- Reference: 1669710615
- News link: https://www.theregister.co.uk/2022/11/29/russia_ransomboggs_ransomware_ukraine/
- Source link:
In a [1]Twitter thread , the ESET researchers wrote that they had detected RansomBoggs deployed within the networks of "multiple organizations in Ukraine." While some aspects of RansomBoggs are different from the malware that has been linked to Sandworm – such as the malware's code being written in .NET – the deployment methods are similar, they wrote.
"There are similarities with previous attacks conducted by #Sandworm: a PowerShell script used to distribute the .NET ransomware from the domain controller is almost identical to the one seen last April during the #Industroyer2 attacks against the energy sector" that were attributed to Sandworm.
[2]
ESET notified Ukrainian cyber security officials about RansomBoggs.
[3]
[4]
The malware's payload is deployed into the organization's network via the PowerShell script, which the Computer Emergency Response Team in Ukraine [5]calls PowerGap and which was used in attacks in Ukraine in March to deliver the CaddyWiper malware, using the ArguePatch loader, according to ESET.
With RansomBoggs, Sandworm adds a cartoonish flair to its serious attacks with references to the 2001 Pixar animated movie Monsters, Inc. The attackers address the ransom note to "Dear human life form!" and introduce themselves as "James P. Sullivan, an employee of Monsters, Inc." James P. Sullivan is the name of the movie's protagonist – a monster with blue and green fur.
[6]
The note is SullivanDecryptsYourFiles.txt, the executable also is named Sullivan and references to the movie also are in the code, according to the ESET researchers. In addition, victims are instructed to reply to the attackers at m0nsters-inc@proton.
The ransomware generates a random key that is RSA encrypted and encrypts files using AES-256 in CBC mode, though the note says it uses AES-128. It also includes a .chsch extension to files that have been encrypted.
"Depending on the malware variant, the RSA public key can either be hardcoded in the malware sample itself or provided as argument," ESET wrote.
[7]Ukraine fears 'massive' Russian cyberattacks on power, infrastructure
[8]Google: Kremlin-backed goons spread Android malware disguised as pro-Ukraine app
[9]False-flag cyberattacks a red line for nation-states, says Mandiant boss
[10]Ukrainian crook jailed in US for selling thousands of stolen login credentials
Sandworm is linked to Unit 74455 of the GRU – Russia's military intelligence outfit – and has been active for since at least the 1990s, including in the suspected development of the NotPetya ransomware in 2017.
The group targeted Ukraine during Russia's 2014 invasion and subsequent occupation of Crimea and has been active since the country launched its latest illegal attack on Ukraine.
[11]
In April, the US announced a [12]$10 million reward for information on six Russian GRU offers linked to Sandworm, accusing them of planning to carry out cyber attacks against American critical infrastructure.
More recently, Sandworm was [13]behind a malware campaign in August reported by cyber security firm Recorded Future that targeted Ukrainian organizations by masquerading as Ukrainian telecommunications service providers and another [14]detected by Microsoft in which Sandworm – which Microsoft refers to as Iridium – launched the Prestige ransomware in October against transportation and logistics industries in Ukraine and Poland.
In their report, researchers with Microsoft's Security Threat Intelligence unit wrote that Iridium "has been consistently active in the war in Ukraine and has been linked to destructive attacks since the start of the war."
The Prestige campaign – which aimed at entities in both Ukraine and Poland – showed a possible shift in the group's "destructive attack calculus, signaling increased risk to organizations directly supplying or transporting humanitarian or military assistance to Ukraine," they wrote.
"More broadly, it may represent an increased risk to organizations in Eastern Europe that may be considered by the Russian state to be providing support relating to the war." ®
Get our [15]Tech Resources
[1] https://twitter.com/ESETresearch/status/1596181925663760386
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y4XmRyJoWJTyytjKXAWSCQAAABc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y4XmRyJoWJTyytjKXAWSCQAAABc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y4XmRyJoWJTyytjKXAWSCQAAABc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://cert.gov.ua/article/39518
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y4XmRyJoWJTyytjKXAWSCQAAABc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/09/27/russia_plans_massive_cyberattacks_ukraine/
[8] https://www.theregister.com/2022/07/20/google_russia_android_malware/
[9] https://www.theregister.com/2022/05/07/false_flag_attacks/
[10] https://www.theregister.com/2022/05/13/ukrainian_credentials_botnet/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y4XmRyJoWJTyytjKXAWSCQAAABc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2022/04/27/feds_10m_reward_sandworm/
[13] https://www.recordedfuture.com/russia-nexus-uac-0113-emulating-telecommunication-providers-in-ukraine
[14] https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
[15] https://whitepapers.theregister.com/
Re: Illegal attack
It does seem an odd phrase. I can't think of any kind of attack that can be considered legal . Even if it was in some way provoked, it's still a wrong thing. Similarly I can't see that defense against an attack could be illegal.
Re: Illegal attack
I noticed the same thing & sort of thought of, like, “Team America: World Police” or such a thing. Or like how UN was fixing to condemn Russia’s war but was thwarted because Russia has the nuclear veto.
I actually got to buy a Big Mac meal & enjoy it outside Lenin’s Tomb in the Red Square, I guess those fun days are done now. I suppose there won’t be any worthwhile reason to ever go back to Russia in my lifetime.
Re: Illegal attack
Russia doesn't have a nuclear veto at the UN - it has a "we beat the Nazis" veto and have had it since before they had nukes. For some reason France also has the veto despite conspicuously not beating the Nazis any more than various other countries did.
Re: Illegal attack
I noticed the same thing & sort of thought of, like, “Team America: World Police” or such a thing. Or like how UN was fixing to condemn Russia’s war but was thwarted because Russia has the nuclear veto.
It's not so much the nuclear veto, more the UN or Security Council vetos. See for example-
https://en.wikipedia.org/wiki/Al-Tanf_(U.S._military_base)
Al-Tanf (Arabic: التَّنْف, romanized: al-Tanf), also known as the Al-Tanf garrison (ATG) is a United States military base within territory controlled by the Syrian opposition in Homs Governorate, Syria.
Which may or may not be part of a legal, or illegal annexation of Syrian territory. US/West tries to formalise the occupation of Syrian territory via the UN, Russia vetos. Syria/Russia try a resolution calling for the removal of US/Western forces from Syria, US/UK/France veto. So the UN becomes pretty much irrelevant in the prevention of conflicts. Even if it were impartial, it's still fairly pointless. The UN passes a resolution condemning conflict in Ukraine, Syria, Ethiopia, Sudan, Yemen, Libya or wherever, and the beligerants won't suddenly go "oh, the UN says we're doing it wrong" and cancel their arms contracts.
Individual nations may however decide to use UN decisions to do their own thing anyway, eg authorise Operation Inherent Resolve and convince partners to invade and attack sovereign nations anyway. As long as that's legal within the nations participating (excluding their opponents), it's legal. Mainly because there isn't really any such thing as 'Internationall Law', just usually a bunch of Treaties and Agreements that may or may not be ignored, or interpreted for convenience.
For a peace-loving world, this is a bit of a problem, and something that could potentially be clarified once the dust settles on all the current armed conflicts ongoing around the world. So answering questions like when, exactly does cyberwarfare, or economic warfare have equivalence to armed warfare? If it's legal to bomb energy infrastructure in Yugoslavia or Iraq, is it legal in Ukraine? If it's illegal to physically attack energy infrastructure in another country, should it also be illegal to damage or disrupt it via cyberwarfare?
Then if those questions are anwsered in 'International Law', shouldn't we expect to see that law applied consistently? And if so, what would be the teeth, when nations can simply ignore, or refuse to recognise International courts.
@proton
Proton Mail? Really? If so, sort it out guys, prove yourselves. Walk the walk. Hopefully a bad move by the rapscallions.
Illegal attack
I hate Putin, and I hope Ukraine kicks out the Russian invaders. That said, I always have to roll my eyes at statements like "Illegal attack". It's not like there are rules on when you're allowed to invade other countries. There's no such thing as international law, at best there's international peer pressure.