Summary:
A campaign linked to the infamous ransomware group LockBit has been recently uncovered. LockBit has gained prominence in the ransomware landscape. To increase their chances of receiving ransom payments from victims, the LockBit ransomware group employs a technique known as double extortion.[/subscribe_to_unlock_form]
Summary:
A campaign linked to the infamous ransomware group LockBit has been recently uncovered. LockBit has gained prominence in the ransomware landscape. To increase their chances of receiving ransom payments from victims, the LockBit ransomware group employs a technique known as double extortion.[emaillocker id="1283"]
For analysis purposes, researchers have selected a specific sample commonly referred to as Office Open XML (OOXML), which is a .docx file format. OOXML files are essentially composed of multiple XML files referred to as parts, packaged together as ZIP archives. Within these parts, various properties are included that collectively govern the document's display and processing. It is worth noting that certain properties within these parts might refer to shared public resources accessible through online URLs. When the malicious document is opened, it initiates an attempt to establish a connection with a remote server in order to retrieve the subsequent component of the attack. This process involves multiple stages of execution. During the initial stage, a URL containing the malicious template file (.dotm) is inserted into the “settings.xml.rels” file, which is located within the document package. By incorporating the URL into the “settings.xml.rels” file, the document gains the capability to retrieve the necessary “.dotm” file from the remote server, which is crucial for subsequent actions to take place. The technique utilized by the attackers aligns with CVE-2017-0199, a known vulnerability in the system.
Infection Chain
Once a successful connection to the remote server is established, the document proceeds to download and execute a malicious template file. The downloaded template file encompasses an obfuscated VBA macro, which has been chosen by the threat actors due to its capability to evade detection mechanisms. The VBA script incorporates a PowerShell command to retrieve the final stage payload, which is an executable file named "tinytask.exe," from the remote server. The downloaded payload corresponds to LockBit ransomware 2.0. Once the LockBit ransomware successfully executes on a system, it proceeds to carry out a series of actions. These actions comprise encrypting files with the “.lockbit” extension, modifying Windows automatic backups by deleting shadow copies through the use of vssadmin.exe, disabling startup repairs using the “bcdedit” tool, and performing additional activities. Furthermore, the ransomware leaves behind a ransom note that contains detailed instructions on how to make the necessary payment.
In a surprising turn of events, the LockBit ransomware has reverted to an old strategy of disseminating its payload through malicious documents. The unexpected change in behavior has caught us off guard, making it challenging to ascertain the motives behind this shift. Nevertheless, it is evident that LockBit continues to pose a significant threat as it constantly evolves and enhances its capabilities, expanding its reach and impact. Hence, it is imperative for users to maintain a high level of vigilance and implement robust security measures to safeguard against potential LockBit ransomware attacks.
Threat Profile:
References:
The following reports contain further technical details:
https://blog.cyble.com/2023/06/06/lockbit-2-0-ransomware-resurfaces/
[/emaillocker]