Mandiant has observed an aggressive financially motivated group,
UNC2447, exploiting one SonicWall VPN zero-day vulnerability prior to
a patch being available and deploying sophisticated malware previously
reported by other vendors as SOMBRAT. Mandiant has linked the use of
SOMBRAT to the deployment of ransomware, which has not been previously
reported publicly.
UNC2447 monetizes intrusions by extorting their victims first with
FIVEHANDS ransomware followed by aggressively applying pressure
through threats of media attention and offering victim data for sale
on hacker forums. UNC2447 has been observed targeting organizations in
Europe and North America and has consistently displayed advanced
capabilities to evade detection and minimize post-intrusion forensics.
Mandiant has observed evidence of UNC2447 affiliated actors
previously using RAGNARLOCKER ransomware. Based on technical and
temporal observations of HELLOKITTY and FIVEHANDS deployments,
Mandiant suspects that HELLOKITTY may have been used by an overall
affiliate program from May 2020 through December 2020, and FIVEHANDS
since approximately January 2021.
In November 2020, Mandiant created UNC2447, an uncategorized group
observed using the novel WARPRISM PowerShell dropper to install BEACON
at two Mandiant Managed Defense clients. Mandiant Managed Defence
quicky neutralized these intrusions and did not observe attempts to
deploy ransomware.
In January and February 2021, Mandiant Consulting observed a novel
rewrite of DEATHRANSOM—dubbed FIVEHANDS—along with SOMBRAT at multiple
victims that were extorted. During one of the ransomware intrusions,
the same WARPRISM and BEACON samples previously clustered under
UNC2447 were observed. Mandiant was able to forensically link the use
of WARPRISM, BEACON, SOMBRAT and FIVEHANDS to the same actor.
Mandiant suspects that HELLOKITTY activity in late-2020 may be
related to the overall affiliate program and that usage shifted to
FIVEHANDS ransomware beginning in January 2021.
Figure 1: FIVEHANDS Hello Kitty icon
When affiliate-based ransomware is observed by Mandiant,
uncategorized clusters are assigned based on the infrastructure used,
and in the case of UNC2447 were based on the SOMBRAT and Cobalt Strike
BEACON infrastructure used across 5 intrusions between November 2020
and February 2021. Generally, Mandiant uses caution even with novel
malware such as SOMBRAT and WARPRISM and clusters each use rigorously
according to all observed activity. For more information on
uncategorized threats, refer to our post, "
Attribution: How Mandiant Tracks Uncategorized Threat Actors."
CVE-2021-20016 is a critical SQL injection vulnerability that
exploits unpatched SonicWall Secure Mobile Access SMA 100 series
remote access products. A remote, unauthenticated attacker could
submit a specially crafted query in order to exploit the
vulnerability. Successful exploitation would grant an attacker the
ability to access login credentials (username, password) as well as
session information that could then be used to log into a vulnerable
unpatched SMA 100 series appliance. This vulnerability only impacted
the SMA 100 series and was patched by SonicWall in February 2021. For
more information on this vulnerability, please refer to
PSIRT advisory SNWLID-2021-0001.
WARPRISM is a PowerShell dropper that has been observed by Mandiant
delivering SUNCRYPT, BEACON, and MIMIKATZ. WARPRISM is used to evade
endpoint detection and will load its payload directly into memory.
WARPRISM may be used by multiple groups.
FOXGRABBER is a command line utility used to harvest FireFox
credential files from remote systems. It contains the PDB path:
C:\Users\kolobko\Source\Repos\grabff\obj\Debug\grabff.pdb. FOXGRABBER
has also been observed in DARKSIDE ransomware intrusions.
In the initial stages of an intrusion, UNC2447 uses the Cobalt
Strike BEACON HTTPSSTAGER implant for persistence to communicate with
command-and-control (C2) servers over HTTPS and has been observed
using ‘chches_APT10’ and ‘Havex’ Malleable profiles.
During the recon and exfiltration stage of intrusions, UNC2447 has
been observed using the following tools: ADFIND, BLOODHOUND, MIMIKATZ,
PCHUNTER, RCLONE, ROUTERSCAN, S3BROWSER, ZAP and 7ZIP. UNC2447 may
tamper with windows security settings, firewall rules, and antivirus protection.
SOMBRAT was first reported by Blackberry Cylance in November 2020 as
"
CostaRicto Campaign: Cyber-Espionage Outsourced" as a
potential espionage-for-hire criminal group. Mandiant has now observed
SOMBRAT alongside FIVEHANDS ransomware intrusions.
The SOMBRAT backdoor is packaged as a 64-bit Windows executable. It
communicates with a configurable command and control (C2) server via
multiple protocols, including DNS, TLS-encrypted TCP, and potentially
WebSockets. Although the backdoor supports dozens of commands, most of
them enable the operator to manipulate an encrypted storage file and
reconfigure the implant. The backdoor's primary purpose is to download
and execute plugins provided via the C2 server. In contrast to the
SOMBRAT version published in November 2020, Mandiant observed
additional obfuscation and armoring to evade detection, this SOMBRAT
variant has been hardened to discourage analysis. Program metadata
typically included by the compiler has been stripped and strings have
been inlined and encoded via XOR-based routines.
This SOMBRAT backdoor variant must be deployed alongside four
additional resources that serve as launchers. They are typically
installed to the hardcoded directory path `C:\ProgramData\Microsoft`.
Other variations of the filenames were observed such as ntuser and wapsvc.
The SOMBRAT backdoor is written in modern C++ and implemented as a
collection of "plugins" that interoperate with one another.
There are five plugins distributed with this variant: `core`,
`network`, `storage`, `taskman`, and `debug` (the `config` plugin
described by Blackberry is not present). The core plugins communicate
with the C2 server via messages sent over a common networking layer;
each plugin supports its own set of messages, and the backdoor
protocol can be extended by dynamically loaded plugins.
The `core` plugin coordinates state tracking, such as network
connectivity, and dynamic plugin loading and unloading. The `network`
plugin configures the networking layer used to communicate with the C2
server, for example enabling the operator to switch between DNS and
TCP protocols. The `storage` plugin exposes logical operations, such
as read and write, for an encrypted file used to store plugins,
resources, and arbitrary data. The `taskman` plugin enables the
operator to list and kill processes on the compromised system.
Finally, the `debuglog` plugin supports a single command to records
debug messages.
Given that the core plugins do not enable an operator directly
execute arbitrary commands or reconfigure the system, the primary
function of the SOMBRAT backdoor is to load plugins provided via the
C2 server. These plugins may be shellcode or DLL modules to be
dynamically loaded. The C2 server may instruct the backdoor to load
the plugins directly or persist them into the encrypted storage file,
where they may subsequently be reloaded, such as after upgrading the backdoor.
Figure 2: Malware author mark “No one is
perfect except me.”
SOMBRAT evades forensic analysis by patching the process memory used
to record command line arguments. It replaces the initial command line
with the base filename of the program executable, removing any
arguments. This means that investigators that inspect a process
listing via memory forensics will see the innocuous-looking command
line `powershell.exe` rather than references to the uncommon filename
such as `WwanSvc.c`.
The SOMBRAT backdoor can communicate with its C2 server using both
DNS and a proxy-aware, TLS-encrypted stream protocol. By default, the
backdoor uses the DNS protocol; however, this can be reconfigured by
the C2 server. Mandiant observed the domains feticost[.]com and
celomito[.]com used for DNS C2 communications.
When the backdoor communicates via its DNS protocol, it constructs
and resolves FQDNs, interpreting the DNS results to extract C2
messages. The authoritative DNS server embeds data within the IP
address field of DNS A record results and within the Name
Administrator field of DNS TEXT record results. By making many
requests to unique subdomains of the C2 domain, the backdoor can
slowly transmit information a few bytes at a time.
Beginning in October 2020, Mandiant observed samples of a customized
version of DEATHRANSOM. This newly modified version removed the
language check feature (Figure 3 shows the language check of DEATHRANSOM).
Figure 3: Language check from
Figure 4: HELLOKITTY mutex shown in
Process Explorer
In January 2021, Mandiant observed a new ransomware deployed against
a victim and assigned the name FIVEHANDS.
DEATHRANSOM is written in C while the other two families are written
in C++. DEATHRANSOM uses a distinct series of do/while loops to
enumerate through network resources, logical drives, and directories.
It also uses QueueUserWorkItem to implement thread pooling for its
file encryption threads.
HELLOKITTY is written in C++, but reimplements a significant portion
of DEATHRANSOM's functionality using similar loop operations and
thread pooling via QueueUserWorkItem. The code structure to enumerate
network resources, logical drives, and perform file encryption is very
similar. Additionally, HELLOKITTY and DEATHRANSOM share very similar
functions to check for the completion status of their encryption
threads before exiting.
FIVEHANDS is written in C++ and although high level functionality is
similar, the function calls and code structure to implement the
majority of the functionality is written differently. Also, instead of
executing threads using QueueUserWorkItem, FIVEHANDS uses
IoCompletionPorts to more efficiently manage its encryption threads.
FIVEHANDS also uses more functionality from the C++ standard template
library (STL) than does HELLOKITTY.
DEATHRANSOM, HELLOKITTY, and FIVEHANDS use the same code to delete
volume shadow copies via WMI by performing the query select * from
Win32_ShadowCopy and then deleting each instance returned by its id.
Each of these three malware families utilizes a similar encryption
scheme. An asymmetric public key is either hard-coded or generated. A
unique symmetric key is generated for each encrypted file.
One significant change between DEATHRANSOM and FIVEHANDS is the use
of a memory-only dropper, which upon execution, expects a command line
switch of -key followed by the key value necessary to perform
decryption of its payload. The payload is stored and encrypted with
AES-128 using an IV of “85471kayecaxaubv”. The decrypted FIVEHANDS
payload is immediately executed after decryption. To date, Mandiant
has only observed encrypted droppers with a common imphash of 8517cf209c905e801241690648f36a97.
FIVEHANDS can receive a CLI argument for a path, this limits the
ransomware's file encryption activities to the specified directory.
DEATHRANSOM and HELLOKITTY do not accept CLI arguments.
DEATHRANSOM performs language ID and keyboard layout checks. If
either of these match Russian, Kazakh, Belarusian, Ukrainian or Tatar
it exits. Neither HELLOKITTY or FIVEHANDS perform language ID or
keyboard checks.
HELLOKITTY performs a mutex check while the other two do not perform
mutex checks.
DEATHRANSOM and HELLOKITTY both exclude the same directories and files:
programdata, $recycle.bin, program files, windows, all users,
appdata, read_me.txt, autoexec.bat, desktop.ini, autorun.inf,
ntuser.dat, iconcache.db, bootsect.bak, boot.ini, ntuser.dat.log, or thumbs.db.
The exclusions for FIVEHANDS are more extensive and contain
additional files and directories to ignore.
|
|
|
|
Programming Language | C++ | C | |
Symmetric Encryption | AES | AES 256 | |
Asymmetric Encryption | |||
Same directory and file name exclusions | No | Yes | Yes |
Accepts CLI Arguments | No | ||
Network Connections | No | ||
Locale Check | No | ||
Mutex Check | No | Yes | No |
Bytes Appended to Encrypted Files | DA DC | AB CD EF AB |
Table 1: Ransomware feature comparison
Mandiant observed SOMBRAT and FIVEHANDS ransomware by the same group
since January 2021. While similarities between HELLOKITTY and
FIVEHANDS are notable, ransomware may be used by different groups
through underground affiliate programs. Mandiant will assign an
uncategorized cluster based on multiple factors including
infrastructure used during intrusions and as such, not all SOMBRAT or
FIVEHANDS ransomware intrusions may have been conducted by UNC2447.
WARPRISM and FOXGRABBER have been used in SUNCRYPT and DARKSIDE
ransomware demonstrating additional complexity and sharing between
different ransomware affiliate programs.
FireEye Network Security FireEye Email Security FireEye Detection On FireEye Malware Analysis FireEye Malware
| valign="top"> |
FireEye EndPoint Security | Real-Time (IOC)
Malware Protection (AV/MG)
|
|
|
Initial Access | |
Execution | |
Defense Evasion | |
Discovery | |
Collection | |
Impact | valign="top"> |
Command and Control | |
Exfiltration |
Thanks to Nick Richard for technical review, Genevieve Stark and
Kimberly Goody for analytical contributions, and Jon Erickson,
Jonathan Lepore, and Stephen Eckels for analysis incorporated into
this blog post.