Lazarus Group, a prominent advanced persistent threat (APT) group linked to North Korea, is behind a little-known strain of ransomware used in attacks earlier this year. Its creation and distribution of VHD ransomware indicates a shift in strategy, report researchers who have been watching it.
VHD ransomware was leveraged in attacks against two organizations in March and April 2020, Kaspersky researchers report. The victims, one located in France and another in Asia, are both large companies in different industry verticals. This ransomware was the main factor tying them together, and analysts noticed a few traits that led them to the Lazarus Group attribution.
The malware itself "doesn't stand out of the ordinary," says Ivan Kwiatkowski, senior security researcher with Kaspersky. "During our first encounter with it, we felt like it was definitely recent and lacking in maturity."
In a description of this first attack, researchers say VHD is written in C++ and crawls connected disks to encrypt files and delete folders called System Volume Information, which are linked to Windows' restore point feature. The malware stops processes that could lock important files, such as Microsoft Exchange and SQL Server. The way operators implemented cryptography is "very unorthodox and not state-of-the-art," though it's not breakable, Kwiatkowski explains.
What reminded them of APT campaigns in this incident was use of a spreader utility hardcoding victim credentials. This propagated the ransomware inside the network and held administrative credentials and IP addresses specific to the victim. The utility used these credentials to brute-force the Server Message Block (SMB) service on every machine it found; when a connection was made, VHD was copied and executed via WMI calls.
Support the originator by clicking the read the rest link below.
