What is Matrix Ransomware?

Matrix is a ransomware family that first emerged in December 2016, mainly targeting small to medium-sized organizations across the globe in countries including the US, Belgium, Germany, Canada and the UK [1]. Although the reported number of Matrix ransomware attacks has remained relatively low in recent years, it has demonstrated ongoing development and gradual improvements to its tactics, techniques, and procedures (TTPs).

How does Matrix Ransomware work?

In earlier versions, Matrix utilized spam email campaigns, exploited Windows shortcuts, and deployed RIG exploit kits to gain initial access to target networks. However, as the threat landscape changed so did Matrix’s approach. Since 2018, Matrix has primarily shifted to brute-force attacks, targeting weak credentials on Windows machines accessible through firewalls. Attackers often exploit common and default credentials, such as “admin”, “password123”, or other unchanged default settings, particularly on systems with Remote Desktop Protocol (RDP) enabled [2] [3].

Darktrace observation of Matrix Ransomware tactics

In May 2024, Darktrace observed an instance of KOK08 ransomware, a specific strain used by Matrix actors, in which some of these ongoing developments and evolutions were observed. Darktrace detected activity indicative of internal reconnaissance, lateral movement, data encryption and exfiltration, with the affected customer later confirming that credentials used for Virtual Private Network (VPN) access had been compromised and used as the initial attack vector.

Another significant tactic observed by Darktrace in this case was the exfiltration of data following encryption, a hallmark of double extortion. This method is employed by attacks to increase pressure on the targeted organization, demanding ransom not only for the decryption of files but also threatening to release the stolen data if their demands are not met. These stakes are particularly high for public sector entities, like the customer in question, as the exposure of sensitive information could result in severe reputational damage and legal consequences, making the pressure to comply even more intense.

Darktrace’s Coverage of Matrix Ransomware

Internal Reconnaissance and Lateral Movement

On May 23, 2024, Darktrace / NETWORK identified a device on the customer’s network making an unusually large number of internal connections to multiple internal devices. Darktrace recognized that this unusual behavior was indicative of internal scanning activity. The connectivity observed around the time of the incident indicated that the Nmap attack and reconnaissance tool was used, as evidenced by the presence of the URI “/nice ports, /Trinity.txt.bak”.

Although Nmap is a crucial tool for legitimate network administration and troubleshooting, it can also be exploited by malicious actors during the reconnaissance phase of the attack. This is a prime example of a ‘living off the land’ (LOTL) technique, where attackers use legitimate, pre-installed tools to carry out their objectives covertly. Despite this, Darktrace’s Self-Learning AI had been continually monitoring devices across the customers network and was able to identify this activity as a deviation from the device’s typical behavior patterns.

Darktrace subsequently observed a significant number of connection attempts using the RDP protocol on port 3389. As RDP typically requires authentication, multiple connection attempts like this often suggest the use of incorrect username and password combinations.

Given the unusual nature of the observed activity, Darktrace’s Autonomous Response capability would typically have intervened, taking actions such as blocking affected devices from making internal connections on a specific port or restricting connections to a particular device. However, Darktrace was not configured to take autonomous action on the customer’s network, and thus their security team would have had to manually apply any mitigative measures.

Later that day, the same device was observed attempting to connect to another internal location via port 445. This included binding to the server service (srvsvc) endpoint via DCE/RPC with the “NetrShareEnum” operation, which was likely being used to list available SMB shares on a device.

Over the following two days, it became clear that the attackers had compromised additional devices and were actively engaging in lateral movement. Darktrace detected two more devices conducting network scans using Nmap, while other devices were observed making extensive WMI requests to internal systems over DCE/RPC. Darktrace recognized that this activity likely represented a coordinated effort to map the customer’s network and identity further internal devices for exploitation.

Beyond identifying the individual events of the reconnaissance and lateral movement phases of this attack’s kill chain, Darktrace’s Cyber AI Analyst was able to connect and consolidate these activities into one comprehensive incident. This not only provided the customer with an overview of the attack, but also enabled them to track the attack’s progression with clarity.

Furthermore, Cyber AI Analyst added additional incidents and affected devices to the investigation in real-time as the attack unfolded. This dynamic capability ensured that the customer was always informed of the full scope of the attack. The streamlined incident consolidation and real-time updates saved valuable time and resources, enabling quicker, more informed decision-making during a critical response window.

File Encryption

On May 28, 2024, another device was observed connecting to another internal location over the SMB filesharing protocol and accessing multiple files with a suspicious extension that had never previously been observed on the network. This activity was a clear sign of ransomware infection, with the ransomware altering the files by adding the “KOK08@QQ[.]COM” email address at the beginning of the filename, followed by a specific pattern of characters. The string consistently followed a pattern of 8 characters (a mix of uppercase and lowercase letters and numbers), followed by a dash, and then another 8 characters. After this, the “.KOK08” extension was appended to each file [1][4].

Data Exfiltration

Shortly after the encryption event, another internal device on the network was observed uploading an unusually large amount of data to the rare external endpoint 38.91.107[.]81 via SSH. The timing of this activity strongly suggests that this exfiltration was part of a double extortion strategy. In this scenario, the attacker not only encrypts the target’s files but also threatens to leak the stolen data unless a ransom is paid, leveraging both the need for decryption and the fear of data exposure to maximize pressure on the victim.

The full impact of this double extortion tactic became evident around two months later when another ransomware group claimed possession of the stolen data and threatened to release it publicly. This development suggested that the initial Matrix ransomware attackers had sold the exfiltrated data to a different group, which was now attempting to monetize it further, highlighting the ongoing risk and potential for exploitation long after the initial attack.

Unfortunately, because Darktrace’s Autonomous Response capability was not enabled at the time, the ransomware attack was able to escalate to the point of data encryption and exfiltration. However, Darktrace’s Security Operations Center (SOC) was still able to support the customer through the Security Operations Support service. This allowed the customer to engage directly with Darktrace’s expert analysts, who provided essential guidance for triaging and investigating the incident. The support from Darktrace’s SOC team not only ensured the customer had the necessary information to remediate the attack but also expedited the entire process, allowing their security team to quickly address the issue without diverting significant resources to the investigation.

Conclusion

In this Matrix ransomware attack on a Darktrace customer in the public sector, malicious actors demonstrated an elevated level of sophistication by leveraging compromised VPN credentials to gain initial access to the target network. Once inside, they exploited trusted tools like Nmap for network scanning and lateral movement to infiltrate deeper into the customer’s environment. The culmination of their efforts was the encryption of files, followed by data exfiltration via SSH, suggesting that Matrix actors were employing double extortion tactics where the attackers not only demanded a ransom for decryption but also threatened to leak sensitive information.

Despite the absence of Darktrace’s Autonomous Response at the time, its anomaly-based approach played a crucial role in detecting the subtle anomalies in device behavior across the network that signalled the compromise, even when malicious activity was disguised as legitimate.  By analyzing these deviations, Darktrace’s Cyber AI Analyst was able to identify and correlate the various stages of the Matrix ransomware attack, constructing a detailed timeline. This enabled the customer to fully understand the extent of the compromise and equipped them with the insights needed to effectively remediate the attack.

Credit to Christina Kreza (Cyber Analyst) and Ryan Traill (Threat Content Lead)

Appendices

Darktrace Model Detections

·       Device / Network Scan

·       Device / Attack and Recon Tools

·       Device / Possible SMB/NTLM Brute Force

·       Device / Suspicious SMB Scanning Activity

·       Device / New or Uncommon SMB Named Pipe

·       Device / Initial Breach Chain Compromise

·       Device / Multiple Lateral Movement Model Breaches

·       Device / Large Number of Model Breaches from Critical Network Device

·       Device / Multiple C2 Model Breaches

·       Device / Lateral Movement and C2 Activity

·       Anomalous Connection / SMB Enumeration

·       Anomalous Connection / New or Uncommon Service Control

·       Anomalous Connection / Multiple Connections to New External TCP Port

·       Anomalous Connection / Data Sent to Rare Domain

·       Anomalous Connection / Uncommon 1 GiB Outbound

·       Unusual Activity / Enhanced Unusual External Data Transfer

·       Unusual Activity / SMB Access Failures

·       Compromise / Ransomware / Suspicious SMB Activity

·       Compromise / Suspicious SSL Activity

List of Indicators of Compromise (IoCs)

·       .KOK08 -  File extension - Extension to encrypted files

·       [KOK08@QQ[.]COM] – Filename pattern – Prefix of the encrypted files

·       38.91.107[.]81 – IP address – Possible exfiltration endpoint

MITRE ATT&CK Mapping

·       Command and control – Application Layer Protocol – T1071

·       Command and control – Web Protocols – T1071.001

·       Credential Access – Password Guessing – T1110.001

·       Discovery – Network Service Scanning – T1046

·       Discovery – File and Directory Discovery – T1083

·       Discovery – Network Share Discovery – T1135

·       Discovery – Remote System Discovery – T1018

·       Exfiltration – Exfiltration Over C2 Channer – T1041

·       Initial Access – Drive-by Compromise – T1189

·       Initial Access – Hardware Additions – T1200

·       Lateral Movement – SMB/Windows Admin Shares – T1021.002

·       Reconnaissance – Scanning IP Blocks – T1595.001

References

[1] https://unit42.paloaltonetworks.com/matrix-ransomware/

[2] https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-matrix-report.pdf

[3] https://cyberenso.jp/en/types-of-ransomware/matrix-ransomware/

[4] https://www.pcrisk.com/removal-guides/10728-matrix-ransomware

There’s a global paradigm shift underway, as we enter the era of AI, that is changing both the way businesses operate and the landscape that they operate within. Our customers are dealing with the impact that AI and automation, as well as the commodification of cybercrime-as-a-service, are having on the threat landscape. Attacks that once took a human weeks or months to propagate can now be done much faster, more effectively, and on a greater scale. Earlier this year, we released our 2024 State of AI Cybersecurity Report which found that 74% of security professionals surveyed agree that AI-powered cyber threats are already having a significant impact on their organizations.

On the other hand, we’ve never been more optimistic that the application of AI in cybersecurity is an essential enabler of innovation. That’s why Darktrace has been building a new model for cybersecurity since our founding in 2013. We remain squarely focused on innovating at the crossroads of AI and cybersecurity to better help our customers build resilience and stay one step ahead of changing threats. We’ve seen first-hand how AI can transform security operations by automating alert triage and freeing up valuable human time to focus on proactively hardening defenses.

As we continue this journey in support of our customers, it’s important that our corporate identity keep pace with our ambitions. We know that the world is a dynamic place, and we believe that a proactive approach to security is the best way to help our customers realize their innovation potential in this new era. To achieve this, we’ve refocused our mission to be the essential cybersecurity platform using AI to proactively defend against novel and known threats.

This week, we introduce a bold new brand promise that encapsulates our focus on championing the defenders who protect companies every day, while also pushing beyond the boundaries of conventional thinking to innovate ahead of current challenges. Defend Beyond – our new brand platform -- achieves just that. More than a brand tagline, Defend Beyond embodies the essence of Darktrace’s ability to harness the power of AI to help our customers to stay ahead of constantly changing cyber threats and threat actors. Take a closer look at this promise through our Defend Beyond brand video.

‍

‍

‍

In addition to this redefined corporate positioning, Darktrace has continued to innovate for our customers. In April, we announced the Darktrace ActiveAI Security Platform™ – an industry leading, AI-native offering that can visualize and correlate threats across the entire enterprise, provide more complete visibility to help mitigate risk, and automate time-intensive tasks to support a preventative and proactive approach to delivering cyber resilience. This platform-based approach allows our customers to be on the leading edge of AI in cybersecurity, while also reducing operational costs through security stack consolidation. Finally, as security operations teams struggle to keep up with the sheer volume of alerts, the Darktrace platform delivers industry-leading, investigative AI to automate the triaging of incidents, and further save human time in the process.

This week, we go a step further as we unveil additional changes to our product portfolio including packaging and product naming. After extensive analysis and customer feedback, we’ve taken steps to streamline and simplify our product packaging. Specifically, our flagship products of Darktrace DETECT™ and Darktrace RESPOND™, along with Cyber AI Analyst™, have now been combined and serve as the foundation of the Darktrace ActiveAI Security platform. This approach ensures that customers benefit from the breadth of our real-time detection, autonomous response, and investigative AI capabilities in the easiest approach possible.

These foundational capabilities can be purchased through any one of the Darktrace primary products, which have been renamed as follows to better align to the challenges our customers are seeking to solve:

• Darktrace / CLOUD™, delivering cyber resilience through real-time and intelligent multi-cloud security‍
• Darktrace / EMAIL™, stopping sophisticated threats up to 13 days faster through revolutionary email security.‍
• Darktrace / NETWORK™, combatting unknown threats with one of the most advanced Network Detection and Response.‍
• Darktrace / OT™, redefining risk management with one of the most comprehensive solutions, purpose- built for critical infrastructure.‍
• Darktrace / IDENTITY™, unifying visibility and control of identity threats across your entire digital enterprise.‍
• Darktrace / ENDPOINT™, providing advanced threat detection and response across devices, anywhere.

Customers can start their Darktrace journey with any of these primary products, realizing the additive benefits of the platform as their deployment grows. Cross platform products deliver value across the platform while also providing unique capabilities within their specific categories. We have renamed these products to better reflect the functionality of our offerings:

• Darktrace PREVENT/E2E is now Proactive Exposure Management, stopping vulnerabilities from becoming reality.
• Darktrace PREVENT/ASM is now Attack Surface Management, identifying and protecting unknown exposed assets.
• Darktrace HEAL is now Incident Readiness & Recovery, uplifting security teams to reduce the impact of an incident.

At Darktrace, supporting our 9,700+ customers is the heart of our purpose and mission. We are inspired by the work they do every day to keep their organizations, and the world, moving in the face of constant change. Over the last year, we've continuously innovated across our products, services, and go-to-market strategy to enable them to stay ahead. The new positioning we're unveiling today is designed to simplify the experience for our customers and reflects our bold ambition to enable defenders today and for the future. I hope you join me in celebrating this evolution as we strive to defend beyond.