Blog

Inside the SOC

CryptBot: How Darktrace foiled a fast-moving information stealer in just 2 seconds

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
23
Jun 2023
23
Jun 2023
This blog discusses Darktrace Threat Research team’s investigation into CryptBot info-stealer infections detected across the customer base between late 2022 and early 2023, and how Darktrace DETECT and RESPOND were able to identify and stop infections within seconds.

The recent trend of threat actors using information stealer malware, designed to gather and exfiltrate confidential data, shows no sign of slowing. With new or updated info-stealer strains appearing in the wild on a regular basis, it came as no surprise to see a surge in yet another prolific variant in late 2022, CryptBot.

What is CryptBot?

CryptBot is a Windows-based trojan malware that was first discovered in the wild in December 2019. It belongs to the prolific category of information stealers whose primary objective, as the name suggests, is to gather information from infected devices and send it to the threat actor.

ZeuS was reportedly the first info-stealer to be discovered, back in 2006. After its code was leaked, many other variants came to light and have been gaining popularity amongst cyber criminals [1] [2] [3]. Indeed, Inside the SOC has discussed multiple infections across its customer base associated with several types of stealers in the past months [4] [5] [6] [7]. 

The Darktrace Threat Research team investigated CryptBot infections on the digital environments of more than 40 different Darktrace customers between October 2022 and January 2023. Darktrace DETECT™ and its anomaly-based approach to threat detection allowed it to successfully identify the unusual activity surrounding these info-stealer infections on customer networks. Meanwhile, Darktrace RESPOND™, when enabled in autonomous response mode, was able to quickly intervene and prevent the exfiltration of sensitive company data.

Why is info-stealer malware popular?

It comes as no surprise that info-stealers have “become one of the most discussed malware types on the cybercriminal underground in 2022”, according to Accenture’s Cyber Threat Intelligence team [10]. This is likely in part due to the fact that:

More sensitive data on devices

Due to the digitization of many aspects of our lives, such as banking and social interactions, a trend accelerated by the COVID-19 pandemic.

Cost effective

Info-stealers provide a great return on investment (ROI) for threat actors looking to exfiltrate data without having to do the traditional internal reconnaissance and data transfer associated with data theft. Info-stealers are usually cheap to purchase and are available through Malware-as-a-Service (MaaS) offerings, allowing less technical and resourceful threat actors in on the stealing action. This makes them a prevalent threat in the malware landscape. 

How does CryptBot work?

The techniques employed by info-stealers to gather and exfiltrate data as well as the type of data targeted vary from malware to malware, but the data targeted typically includes login credentials for a variety of applications, financial information, cookies and global information about the infected computer [8]. Given its variety and sensitivity, threat actors can leverage the stolen data in several ways to make a profit. In the case of CryptBot, the data obtained is sold on forums or underground data marketplaces and can be later employed in higher profile attacks [9]. For example, stolen login information has previously been leveraged in credential-based attacks, which can successfully bypass authentication-based security measures, including multi-factor authentication (MFA). 

CryptBot functionalities

Like many information stealers, CryptBot is designed to steal a variety of sensitive personal and financial information such as browser credentials, cookies and history information and social media accounts login information, as well as cryptocurrency wallets and stored credit card information [11]. General information (e.g., OS, installed applications) about the infected computer is also retrieved. Browsers targeted by CryptBot include Chrome, Firefox, and Edge. In early 2022, CryptBot’s code was revamped in order to streamline its data extraction capabilities and improve its overall efficiency, an update that coincided with a rise in the number of infections [11] [12].

Some of CryptBot's functionalities were removed and its exfiltration process was streamlined, which resulted in a leaner payload, around half its original size and a quicker infection process [11]. Some of the features removed included sandbox detection and evasion functionalities, the collection of desktop text files and screen captures, which were deemed unnecessary. At the same time, the code was improved in order to include new Chrome versions released after CryptBot’s first appearance in 2019. Finally, its exfiltration process was simplified: prior to its 2022 update, the malware saved stolen data in two separate folders before sending it to two separate command and control (C2) domains. Post update, the data is only saved in one location and sent to one C2 domain, which is hardcoded in the C2 transmission function of the code. This makes the infection process much more streamlined, taking only a few minutes from start to finish. 

Aside from the update to its malware code, CryptBot regularly updates and refreshes its C2 domains and dropper websites, making it a highly fluctuating malware with constantly new indicators of compromise and distribution sites. 

Even though CryptBot is less known than other info-stealers, it was reportedly infecting thousands of devices daily in the first months of 2020 [13] and its continued prevalence resulted in Google taking legal action against its distribution infrastructure at the end of April 2023 [14].  

How is CryptBot obtained?

CryptBot is primarily distributed through malicious websites offering free and illegally modified software (i.e., cracked software) for common commercial programs (e.g., Microsoft Windows and Office, Adobe Photoshop, Google Chrome, Nitro PDF Pro) and video games. From these ‘malvertising’ pages, the user is redirected through multiple sites to the actual payload dropper page [15]. This distribution method has seen a gain in popularity amongst info-stealers in recent months and is also used by other malware families such as Raccoon Stealer and Vidar [16] [17].

A same network of cracked software websites can be used to download different malware strains, which can result in multiple simultaneous infections. Additionally, these networks often use search engine optimization (SEO) in order to make adverts for their malware distributing sites appear at the top of the Google search results page, thus increasing the chances of the malicious payloads being downloaded.

Furthermore, CryptBot leverages Pay-Per-Install (PPI) services such as 360Installer and PrivateLoader, a downloader malware family used to deliver payloads of multiple malware families operated by different threat actors [18] [19] [20]. The use of this distribution method for CryptBot payloads appears to have stemmed from its 2022 update. According to Google, 161 active domains were associated with 360Installer, of which 90 were associated with malware delivery activities and 29 with the delivery of CryptBot malware specifically. Google further identified hundreds of domains used by CryptBot as C2 sites, all of which appear to be hosted on the .top top-level domain [21].

This simple yet effective distribution tactic, combined with the MaaS model and the lucrative prospects of selling the stolen data resulted in numerous infections. Indeed, CryptBot was estimated to have infected over 670,000 computers in 2022 [14]. Even though the distribution method chosen means that most of the infected devices are likely to be personal computers, bring your own device (BYOD) policies and users’ tendency to reuse passwords means that corporate environments are also at risk. 

CryptBot Attack Overview

In some cases observed by Darktrace, after connecting to malvertising websites, devices were seen making encrypted SSL connections to file hosting services such as MediaFire or Mega, while in others devices were observed connecting to an endpoint associated with a content delivery network. This is likely the location from where the malware payload was downloaded alongside cracked software, which is executed by the unsuspecting user. As the user expects to run an executable file to install their desired software, the malware installation often happens without the user noticing.

Some of the malvertising sites observed by Darktrace on customer deployments were crackful[.]com, modcrack[.]net, windows-7-activator[.]com and office-activator[.]com. However, in many cases detected by Darktrace, CryptBot was propagated via websites offering trojanized KMSPico software (e.g., official-kmspico[.]com, kmspicoofficial[.]com). KMSPico is a popular Microsoft Windows and Office product activator that emulates a Windows Key Management Services (KMS) server to activate licenses fraudulently. 

Once it has been downloaded and executed, CryptBot will search the system for confidential information and create a folder with a seemingly randomly generated name, matching the regex [a-zA-Z]{10}, to store the gathered sensitive data, ready for exfiltration. 

Figure 1: Packet capture (PCAP) of an HTTP POST request showing the file with the stolen data being sent over the connection.
Figure 1: Packet capture (PCAP) of an HTTP POST request showing the file with the stolen data being sent over the connection.

This data is then sent to the C2 domain via HTTP POST requests on port 80 to the URI /gate.php. As previously stated, CryptBot C2 infrastructure is changed frequently and many of the domains seen by Darktrace had been registered within the previous 30 days. The domain names detected appeared to have been generated by an algorithm, following the regex patterns [a-z]{6}[0-9]{2,3}.top or [a-z]{6}[0-9]{2,3}.cfd. In several cases, the C2 domain had not been flagged as malicious by other security vendors or had just one detection. This is likely because of the frequent changes in the C2 infrastructure operated by the threat actors behind CryptBot, with new malicious domains being created periodically to avoid detection. This makes signature-based security solutions much less efficient to detect and block connections to malicious domains. Additionally, the fact that the stolen data is sent over regular HTTP POST requests, which are used daily as part of a multitude of legitimate processes such as file uploads or web form submissions, allows the exfiltration connections to blend in with normal and legitimate traffic making it difficult to isolate and detect as malicious activity. 

In this context, anomaly-based security detections such as Darktrace DETECT are the best way to pick out these anomalous connections amidst legitimate Internet traffic. In the case of CryptBot, two DETECT models were seen consistently breaching for CryptBot-related activity: ‘Device / Suspicious Domain’, breaching for connections to 100% rare C2 .top domains, and ‘Anomalous Connection / POST to PHP on New External Host’, breaching on the data exfiltration HTTP POST request. 

In deployments where Darktrace RESPOND was deployed, a RESPOND model breached within two seconds of the first HTTP POST request. If enabled in autonomous mode, RESPOND would block the data exfiltration connections, thus preventing the data safe from being sold in underground forums to other threat actors. In one of the cases investigated by Darktrace’s Threat Research team, DETECT was able to successfully identify and alert the customer about CryptBot-related malicious activity on a device that Darktrace had only begun to monitor one day before, showcasing how fast Darktrace’s Self-Learning AI learns every nuance of customer networks and the devices within it.

In most cases investigated by Darktrace, fewer than 5 minutes elapsed between the first connection to the endpoint offering free cracked software and the data being exfiltrated to the C2 domain. For example, in one of the attack chains observed in a university’s network, a device was seen connecting to the 100% rare endpoint official-kmspico[.]com at 16:53:47 (UTC).

Device Event Log showing SSL connections to the official-kmspico[.]com malvertising website.
Figure 2: Device Event Log showing SSL connections to the official-kmspico[.]com malvertising website.

One minute later, at 16:54:19 (UTC), the same device was seen connecting to two mega[.]co[.]nz subdomains and downloading around 13 MB of data from them. As mentioned previously, these connections likely represent the CryptBot payload and cracked software download.

Device Event Log showing SSL connections to mega[.]com endpoints following the connection to the malvertising site.
Figure 3: Device Event Log showing SSL connections to mega[.]com endpoints following the connection to the malvertising site.

At 16:56:01 (UTC), Darktrace detected the device making a first HTTP POST request to the 100% rare endpoint, avomyj24[.]top, which has been associated with CryptBot’s C2 infrastructure [22]. This initial HTTP POST connection likely represents the transfer of confidential data to the attacker’s infrastructure.

Device Event Log showing HTTP connections made by the infected device to the C2 domain. 
Figure 4: Device Event Log showing HTTP connections made by the infected device to the C2 domain. 

The full attack chain, from visiting the malvertising website to the malicious data egress, took less than three minutes to complete. In this circumstance, the machine-speed detection and response capabilities offered by Darktrace DETECT and RESPOND are paramount in order to stop CryptBot before it can successfully exfiltrates sensitive data. This is an incredibly quick infection timeline, with no lateral movement nor privilege escalation required to carry out the malware’s objective. 

Device Event Log showing the DETECT and RESPOND models breached during the attack. 
Figure 5: Device Event Log showing the DETECT and RESPOND models breached during the attack. 

Darktrace Cyber AI Analyst incidents were also generated as a result of this activity, displaying all relevant information in one panel for easy review by customer security teams.

Cyber AI Analyst event log showing the HTTP connections made by the breach device to the C2 endpoint.
Figure 6: Cyber AI Analyst event log showing the HTTP connections made by the breach device to the C2 endpoint.

Conclusion 

CryptBot info-stealer is fast, efficient, and apt at evading detection given its small size and swift process of data gathering and exfiltration via legitimate channels. Its constantly changing C2 infrastructure further makes it difficult for traditional security tools that really on rules and signatures or known indicators of compromise (IoCs) to detect these infections. 

In the face of such a threat, Darktrace’s anomaly-based detection allows it to recognize subtle deviations in a device’s pattern of behavior that may signal an evolving threat and instantly bring it to the attention of security teams. Darktrace DETECT is able to distinguish between benign activity and malicious behavior, even from newly monitored devices, while Darktrace RESPOND can move at machine-speed to prevent even the fastest moving threat actors from stealing confidential company data, as it demonstrated here by stopping CryptBot infections in as little as 2 seconds.

Credit to Alexandra Sentenac, Cyber Analyst, Roberto Romeu, Senior SOC Analyst

Darktrace Model Detections  

AI Analyst Coverage 

  • Possible HTTP Command and Control  

DETECT Model Breaches  

  • Device / Suspicious Domain 
  • Anomalous Connection / POST to PHP on New External Host 
  • Anomalous Connection / Multiple HTTP POSTs to Rare Hostname 
  • Compromise / Multiple SSL to Rare DGA Domains

List of IOCs

Indicator Type Description
luaigz34[.]top Hostname CryptBot C2 endpoint
watibt04[.]top Hostname CryptBot C2 endpoint
avolsq14[.]top Hostname CryptBot C2 endpoint

MITRE ATT&CK Mapping

Category Technique Tactic
INITIAL ACCESS Drive-by Compromise - T1189 N/A
COMMAND AND CONTROL Web Protocols - T1071.001 N/A
COMMAND AND CONTROL Domain Generation Algorithm - T1568.002 N/A

References

[1] https://www.malwarebytes.com/blog/threats/info-stealers

[2] https://cybelangel.com/what-are-infostealers/

[3] https://ke-la.com/information-stealers-a-new-landscape/

[4] https://darktrace.com/blog/vidar-info-stealer-malware-distributed-via-malvertising-on-google

[5] https://darktrace.com/blog/a-surge-of-vidar-network-based-details-of-a-prolific-info-stealer 

[6] https://darktrace.com/blog/laplas-clipper-defending-against-crypto-currency-thieves-with-detect-respond

[7] https://darktrace.com/blog/amadey-info-stealer-exploiting-n-day-vulnerabilities 

[8] https://cybelangel.com/what-are-infostealers/

[9] https://webz.io/dwp/the-top-10-dark-web-marketplaces-in-2022/

[10] https://www.accenture.com/us-en/blogs/security/information-stealer-malware-on-dark-web

[11] https://www.bleepingcomputer.com/news/security/revamped-cryptbot-malware-spread-by-pirated-software-sites/

[12] https://blogs.blackberry.com/en/2022/03/threat-thursday-cryptbot-infostealer

[13] https://www.deepinstinct.com/blog/cryptbot-how-free-becomes-a-high-price-to-pay

[14] https://blog.google/technology/safety-security/continuing-our-work-to-hold-cybercriminal-ecosystems-accountable/

[15] https://asec.ahnlab.com/en/31802/

[16] https://darktrace.com/blog/the-last-of-its-kind-analysis-of-a-raccoon-stealer-v1-infection-part-1

[17] https://www.trendmicro.com/pt_br/research/21/c/websites-hosting-cracks-spread-malware-adware.html

[18] https://intel471.com/blog/privateloader-malware

[19] https://cyware.com/news/watch-out-pay-per-install-privateloader-malware-distribution-service-is-flourishing-888273be 

[20] https://regmedia.co.uk/2023/04/28/handout_google_cryptbot_complaint.pdf

[21] https://www.bankinfosecurity.com/google-wins-court-order-to-block-cryptbot-infrastructure-a-21905

[22] https://github.com/stamparm/maltrail/blob/master/trails/static/malware/cryptbot.txt

INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Alexandra Sentenac
Cyber Analyst
Book a 1-1 meeting with one of our experts
share this article
COre coverage
No items found.

More in this series

No items found.

Safeguarding Distribution Centers in the Digital Age

Default blog imageDefault blog image
12
Jun 2024

Challenges securing distribution centers

For large retail providers, e-commerce organizations, logistics & supply chain organizations, and other companies who rely on the distribution of goods to consumers cybersecurity efforts are often focused on an immense IT infrastructure. However, there's a critical, often overlooked segment of infrastructure that demands vigilant monitoring and robust protection: distribution centers.

Distribution centers play a critical role in the business operations of supply chains, logistics, and the retail industry. They serve as comprehensive logistics hubs, with many organizations operating multiple centers worldwide to meet consumer needs. Depending on their size and hours of operation, even just one hour of downtime at these centers can result in significant financial losses, ranging from tens to hundreds of thousands of dollars per hour.

Due to the time-sensitive nature and business criticality of distribution centers, there has been a rise in applying modern technologies now including AI applications to enhance efficiency within these facilities. Today’s distribution centers are increasingly connected to Enterprise IT networks, the cloud and the internet to manage every stage of the supply chain. Additionally, it is common for organizations to allow 3rd party access to the distribution center networks and data for reasons including allowing them to scale their operations effectively.

However, this influx of new technologies and interconnected systems across IT, OT and cloud introduces new risks on the cybersecurity front. Distribution center networks include industrial operational technologies ICS/OT, IoT technologies, enterprise network technology, and cloud systems working in coordination. The convergence of these technologies creates a greater chance that blind spots exist for security practitioners and this increasing presence of networked technology increases the attack surface and potential for vulnerability. Thus, having cybersecurity measures that cover IT, OT or Cloud alone is not enough to secure a complex and dynamic distribution center network infrastructure.  

The OT network encompasses various systems, devices, hardware, and software, such as:

  • Enterprise Resource Planning (ERP)
  • Warehouse Execution System (WES)
  • Warehouse Control System (WCS)
  • Warehouse Management System (WMS)
  • Energy Management Systems (EMS)
  • Building Management Systems (BMS)
  • Distribution Control Systems (DCS)
  • Enterprise IT devices
  • OT and IoT: Engineering workstations, ICS application and management servers, PLCs, HMI, access control, cameras, and printers
  • Cloud applications

Distribution centers: An expanding attack surface

As these distribution centers have become increasingly automated, connected, and technologically advanced, their attack surfaces have inherently increased. Distribution centers now have a vastly different potential for cyber risk which includes:  

  • More networked devices present
  • Increased routable connectivity within industrial systems
  • Externally exposed industrial control systems
  • Increased remote access
  • IT/OT enterprise to industrial convergence
  • Cloud connectivity
  • Contractors, vendors, and consultants on site or remoting in  

Given the variety of connected systems, distribution centers are more exposed to external threats than ever before. Simultaneously, distribution center’s business criticality has positioned them as interesting targets to cyber adversaries seeking to cause disruption with significant financial impact.

Increased connectivity requires a unified security approach

When assessing the unique distribution center attack surface, the variety of interconnected systems and devices requires a cybersecurity approach that can cover the diverse technology environment.  

From a monitoring and visibility perspective, siloed IT, OT or cloud security solutions cannot provide the comprehensive asset management, threat detection, risk management, and response and remediation capabilities across interconnected digital infrastructure that a solution natively covering IT, cloud, OT, and IoT can provide.  

The problem with using siloed cybersecurity solutions to cover a distribution center is the visibility gaps that are inherently created when using multiple solutions to try and cover the totality of the diverse infrastructure. What this means is that for cross domain and multi-stage attacks, depending on the initial access point and where the adversary plans on actioning their objectives, multiple stages of the attack may not be detected or correlated if they security solutions lack visibility into OT, IT, IoT and cloud.

Comprehensive security under one solution

Darktrace leverages Self-Learning AI, which takes a new approach to cybersecurity. Instead of relying on rules and signatures, this AI trains on the specific business to learn a ‘pattern of life’ that models normal activity for every device, user, and connection. It can be applied anywhere an organization has data, and so can natively cover IT, OT, IoT, and cloud.  

With these models, Darktrace /OT provides improved visibility, threat detection and response, and risk management for proactive hardening recommendations.  

Visibility: Darktrace is the only OT security solution that natively covers IT, IoT and OT in unison. AI augmented workflows ensure OT cybersecurity analysts and operation engineers can manage IT and OT environments, leveraging a live asset inventory and tailored dashboards to optimize security workflows and minimize operator workload.

Threat detection, investigation, and response: The AI facilitates anomaly detection capable of detecting known, unknown, and insider threats and precise response for OT environments that contains threats at their earliest stages before they can jeopardize control systems. Darktrace immediately understands, identifies, and investigates all anomalous activity in OT networks, whether human or machine driven and uses Explainable AI to generate investigation reports via Darktrace’s Cyber AI Analyst.

Proactive risk identification: Risk management capabilities like attack path modeling can prioritize remediation and mitigation that will most effectively reduce derived risk scores. Rather than relying on knowledge of past attacks and CVE lists and scores, Darktrace AI learns what is ‘normal’ for its environment, discovering previously unknown threats and risks by detecting subtle shifts in behavior and connectivity. Through the application of Darktrace AI for OT environments, security teams can investigate novel attacks, discover blind spots, get live-time visibility across all their physical and digital assets, and reduce the time to detect, respond to, and triage security events.

Continue reading
About the author
Daniel Simonds
Director of Operational Technology

Blog

Inside the SOC

Medusa Ransomware: Looking Cyber Threats in the Eye with Darktrace

Default blog imageDefault blog image
10
Jun 2024

What is Living off the Land attack?

In the face of increasingly vigilant security teams and adept defense tools, attackers are continually looking for new ways to circumvent network security and gain access to their target environments. One common tactic is the leveraging of readily available utilities and services within a target organization’s environment in order to move through the kill chain; a popular method known as living off the land (LotL). Rather than having to leverage known malicious tools or write their own malware, attackers are able to easily exploit the existing infrastructure of their targets.

The Medusa ransomware group in particular are known to extensively employ LotL tactics, techniques and procedures (TTPs) in their attacks, as one Darktrace customer in the US discovered in early 2024.

What is Medusa Ransomware?

Medusa ransomware (not to be confused with MedusaLocker) was first observed in the wild towards the end of 2022 and has been a popular ransomware strain amongst threat actors since 2023 [1]. Medusa functions as a Ransomware-as-a-Service (RaaS) platform, providing would-be attackers, also know as affiliates, with malicious software and infrastructure required to carry out disruptive ransomware attacks. The ransomware is known to target organizations across many different industries and countries around the world, including healthcare, education, manufacturing and retail, with a particular focus on the US [2].

How does medusa ransomware work?

Medusa affiliates are known to employ a number of TTPs to propagate their malware, most prodominantly gaining initial access by exploiting vulnerable internet-facing assets and targeting valid local and domain accounts that are used for system administration.

The ransomware is typically delivered via phishing and spear phishing campaigns containing malicious attachments [3] [4], but it has also been observed using initial access brokers to access target networks [5]. In terms of the LotL strategies employed in Medusa compromises, affiliates are often observed leveraging legitimate services like the ConnectWise remote monitoring and management (RMM) software and PDQ Deploy, in order to evade the detection of security teams who may be unable to distinguish the activity from normal or expected network traffic [2].

According to researchers, Medusa has a public Telegram channel that is used by threat actors to post any data that may have been stolen, likely in an attempt to extort organizations and demand payment [2].  

Darktrace’s Coverage of Medusa Ransomware

Established Foothold and C2 activity

In March 2024, Darktrace /NETWORK identified over 80 devices, including an internet facing domain controller, on a customer network performing an unusual number of activities that were indicative of an emerging ransomware attack. The suspicious behavior started when devices were observed making HTTP connections to the two unusual endpoints, “wizarr.manate[.]ch” and “go-sw6-02.adventos[.]de”, with the PowerShell and JWrapperDownloader user agents.

Darktrace’s Cyber AI Analyst™ launched an autonomous investigation into the connections and was able to connect the seemingly separate events into one wider incident spanning multiple different devices. This allowed the customer to visualize the activity in chronological order and gain a better understanding of the scope of the attack.

At this point, given the nature and rarity of the observed activity, Darktrace /NETWORK's autonomous response would have been expected to take autonomous action against affected devices, blocking them from making external connections to suspicious locations. However, autonomous response was not configured to take autonomous action at the time of the attack, meaning any mitigative actions had to be manually approved by the customer’s security team.

Internal Reconnaissance

Following these extensive HTTP connections, between March 1 and 7, Darktrace detected two devices making internal connection attempts to other devices, suggesting network scanning activity. Furthermore, Darktrace identified one of the devices making a connection with the URI “/nice ports, /Trinity.txt.bak”, indicating the use of the Nmap vulnerability scanning tool. While Nmap is primarily used legitimately by security teams to perform security audits and discover vulnerabilities that require addressing, it can also be leveraged by attackers who seek to exploit this information.

Darktrace / NETWORK model alert showing the URI “/nice ports, /Trinity.txt.bak”, indicating the use of Nmap.
Figure 1: Darktrace /NETWORK model alert showing the URI “/nice ports, /Trinity.txt.bak”, indicating the use of Nmap.

Darktrace observed actors using multiple credentials, including “svc-ndscans”, which was also seen alongside DCE-RPC activity that took place on March 1. Affected devices were also observed making ExecQuery and ExecMethod requests for IWbemServices. ExecQuery is commonly utilized to execute WMI Query Language (WQL) queries that allow the retrieval of information from WI, including system information or hardware details, while ExecMethod can be used by attackers to gather detailed information about a targeted system and its running processes, as well as a tool for lateral movement.

Lateral Movement

A few hours after the first observed scanning activity on March 1, Darktrace identified a chain of administrative connections between multiple devices, including the aforementioned internet-facing server.

Cyber AI Analyst was able to connect these administrative connections and separate them into three distinct ‘hops’, i.e. the number of administrative connections made from device A to device B, including any devices leveraged in between. The AI Analyst investigation was also able to link the previously detailed scanning activity to these administrative connections, identifying that the same device was involved in both cases.

Cyber AI Analyst investigation into the chain of lateral movement activity.
Figure 2: Cyber AI Analyst investigation into the chain of lateral movement activity.

On March 7, the internet exposed server was observed transferring suspicious files over SMB to multiple internal devices. This activity was identified as unusual by Darktrace compared to the device's normal SMB activity, with an unusual number of executable (.exe) and srvsvc files transferred targeting the ADMIN$ and IPC$ shares.

Cyber AI Analyst investigation into the suspicious SMB write activity.
Figure 3: Cyber AI Analyst investigation into the suspicious SMB write activity.
Graph highlighting the number of successful SMB writes and the associated model alerts.
Figure 4: Graph highlighting the number of successful SMB writes and the associated model alerts.

The threat actor was also seen writing SQLite3*.dll files over SMB using a another credential this time. These files likely contained the malicious payload that resulted in the customer’s files being encrypted with the extension “.s3db”.

Darktrace’s visibility over an affected device performing successful SMB writes.
Figure 5: Darktrace’s visibility over an affected device performing successful SMB writes.

Encryption of Files

Finally, Darktrace observed the malicious actor beginning to encrypt and delete files on the customer’s environment. More specifically, the actor was observed using credentials previously seen on the network to encrypt files with the aforementioned “.s3db” extension.

Darktrace’s visibility over the encrypted files.
Figure 6: Darktrace’s visibility over the encrypted files.


After that, Darktrace observed the attacker encrypting  files and appending them with the extension “.MEDUSA” while also dropping a ransom note with the file name “!!!Read_me_Medusa!!!.txt”

Darktrace’s detection of threat actors deleting files with the extension “.MEDUSA”.
Figure 7: Darktrace’s detection of threat actors deleting files with the extension “.MEDUSA”.
Darktrace’s detection of the Medusa ransom note.
Figure 8: Darktrace’s detection of the Medusa ransom note.

At the same time as these events, Darktrace observed the attacker utilizing a number of LotL techniques including SSL connections to “services.pdq[.]tools”, “teamviewer[.]com” and “anydesk[.]com”. While the use of these legitimate services may have bypassed traditional security tools, Darktrace’s anomaly-based approach enabled it to detect the activity and distinguish it from ‘normal’’ network activity. It is highly likely that these SSL connections represented the attacker attempting to exfiltrate sensitive data from the customer’s network, with a view to using it to extort the customer.

Cyber AI Analyst’s detection of “services.pdq[.]tools” usage.
Figure 9: Cyber AI Analyst’s detection of “services.pdq[.]tools” usage.

If this customer had been subscribed to Darktrace's Proactive Threat Notification (PTN) service at the time of the attack, they would have been promptly notified of these suspicious activities by the Darktrace Security Operation Center (SOC). In this way they could have been aware of the suspicious activities taking place in their infrastructure before the escalation of the compromise. Despite this, they were able to receive assistance through the Ask the Expert service (ATE) whereby Darktrace’s expert analyst team was on hand to assist the customer by triaging and investigating the incident further, ensuring the customer was well equipped to remediate.  

As Darktrace /NETWORK's autonomous response was not enabled in autonomous response mode, this ransomware attack was able to progress to the point of encryption and data exfiltration. Had autonomous response been properly configured to take autonomous action, Darktrace would have blocked all connections by affected devices to both internal and external endpoints, as well as enforcing a previously established “pattern of life” on the device to stop it from deviating from its expected behavior.

Conclusion

The threat actors in this Medusa ransomware attack attempted to utilize LotL techniques in order to bypass human security teams and traditional security tools. By exploiting trusted systems and tools, like Nmap and PDQ Deploy, attackers are able to carry out malicious activity under the guise of legitimate network traffic.

Darktrace’s Self-Learning AI, however, allows it to recognize the subtle deviations in a device’s behavior that tend to be indicative of compromise, regardless of whether it appears legitimate or benign on the surface.

Further to the detection of the individual events that made up this ransomware attack, Darktrace’s Cyber AI Analyst was able to correlate the activity and collate it under one wider incident. This allowed the customer to track the compromise and its attack phases from start to finish, ensuring they could obtain a holistic view of their digital environment and remediate effectively.

Credit to Maria Geronikolou, Cyber Analyst, Ryan Traill, Threat Content Lead

Appendices

Darktrace DETECT Model Detections

Anomalous Connection / SMB Enumeration

Device / Anomalous SMB Followed By Multiple Model Alerts

Device / Suspicious SMB Scanning Activity

Device / Attack and Recon Tools

Device / Suspicious File Writes to Multiple Hidden SMB Share

Compromise / Ransomware / Ransom or Offensive Words Written to SMB

Device / Internet Facing Device with High Priority Alert

Device / Network Scan

Anomalous Connection / Powershell to Rare External

Device / New PowerShell User Agent

Possible HTTP Command and Control

Extensive Suspicious DCE-RPC Activity

Possible SSL Command and Control to Multiple Endpoints

Suspicious Remote WMI Activity

Scanning of Multiple Devices

Possible Ransom Note Accessed over SMB

List of Indicators of Compromise (IoCs)

IoC – Type – Description + Confidence

207.188.6[.]17      -     IP address   -      C2 Endpoint

172.64.154[.]227 - IP address -        C2 Endpoint

wizarr.manate[.]ch  - Hostname -       C2 Endpoint

go-sw6-02.adventos[.]de.  Hostname  - C2 Endpoint

.MEDUSA             -        File extension     - Extension to encrypted files

.s3db               -             File extension    -  Created file extension

SQLite3-64.dll    -        File           -               Used tool

!!!Read_me_Medusa!!!.txt - File -   Ransom note

Svc-ndscans         -         Credential     -     Possible compromised credential

Svc-NinjaRMM      -       Credential      -     Possible compromised credential

MITRE ATT&CK Mapping

Discovery  - File and Directory Discovery - T1083

Reconnaissance    -  Scanning IP            -          T1595.001

Reconnaissance -  Vulnerability Scanning -  T1595.002

Lateral Movement -Exploitation of Remote Service -  T1210

Lateral Movement - Exploitation of Remote Service -   T1210

Lateral Movement  -  SMB/Windows Admin Shares     -    T1021.002

Lateral Movement   -  Taint Shared Content          -            T1080

Execution   - PowerShell     - T1059.001

Execution  -   Service Execution   -    T1059.002

Impact   -    Data Encrypted for Impact  -  T1486

References

[1] https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/

[2] https://thehackernews.com/2024/01/medusa-ransomware-on-rise-from-data.html

[3] https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/unveiling-the-latest-ransomware-threats-targeting-the-casino-and-entertainment-industry/

[4] https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/security-advisory-for-medusa-ransomware

[5] https://thehackernews.com/2024/01/medusa-ransomware-on-rise-from-data.html

[6]https://any.run/report/8be3304fec9d41d44012213ddbb28980d2570edeef3523b909af2f97768a8d85/e4c54c9d-12fd-477f-8cbb-a20f8fb98912

Continue reading
About the author
Maria Geronikolou
Cyber Analyst
Our ai. Your data.

Elevate your cyber defenses with Darktrace AI

Start your free trial
Darktrace AI protecting a business from cyber threats.