Tweet

SophosLabs

12 May, 8 tweets, 4 min read

NEW RESEARCH: A defender's view inside a #DarkSide ransomware attack ***

What to expect when you’re targeted by a headline-seeking threat actor... (a thread)

1/8

The recent ransomware intrusion of a major US gasoline pipeline operator was the work of an affiliate of #DarkSide, a ransomware ring that has been responsible for at least 60 known cases of ransomware double-extortion so far this year.

2/8

DarkSide has struck several high-profile victims recently, including companies listed on the NASDAQ stock exchange.

3/8

But the disruption of Colonial Pipeline's network led to the company shutting down its operational technology (OT) network as well—effectively cutting off a majority of the gasoline supply to the eastern United States.

4/8

The shutdown of #ColonialPipeline is not the first critical infrastructure issue triggered by a ransomware attack. Last February, a US-based natural gas facility was shut down for two days by a ransomware intrusion that spread to its OT network.

5/8

And DarkSide has not avoided these types of companies, either, hitting a Brazilian energy company earlier this year. But the Colonial incident has potentially greater real-world impact—and has apparently made DarkSide’s operators more notorious than they’re comfortable with.

6/8

The Sophos Rapid Response team has been called in for incident response or to intervene during an attack involving DarkSide on at least five different instances in the past year.

7/8

@thepacketrat

See our full #DarkSide report: news.sophos.com/en-us/2021/05/…

By @thepacketrat @markloman @AltShiftPrtScn

SophosLabs would like to acknowledge Yusuf Arslan Polat, Gabor Szappanos, Suriya Natarajan, Szabolcs Lévai, and Ferenc László Nagy for their contributions to this post.

8/8

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @SophosLabs

SophosLabs

@SophosLabs

11 May

NEW: May’s Patch Tuesday brings a lighter-than-usual number of Windows updates

... But fewer patches does not make the bugs less dangerous

(a thread) 1/9

The recent history of Patch Tuesday releases has seen Microsoft updating upwards of 100 software bugs every month, but that trend is broken today when the company fixes just 55 vulnerabilities across their products. 2/9

Synchronized to release in parallel with Microsoft’s updates, Adobe is also fixing 11 bugs in their Acrobat Reader software, one of which (CVE-2021-28550/APSB21-29) is reportedly being “exploited in the wild in limited attacks targeting Adobe Reader users on Windows,” 3/9

Read 10 tweets

SophosLabs

@SophosLabs

23 Mar

NEW RESEARCH: Black Kingdom ransomware begins appearing on Exchange servers

***
A novel, if not particularly well made, ransomware is spreading to Exchange servers that haven't been patched against the ProxyLogon exploit.

(a thread)

1/15

Following the #DearCry ransomware attacks reported on last week, another ransomware gang has also started to target vulnerable Exchange servers with another ransomware, called #BlackKingDom.

2/15

Sophos telemetry began detecting the ransomware on Thursday March 18 as it targeted Exchange servers that remain unpatched against the ProxyLogon vulnerabilities disclosed by Microsoft earlier this month.

3/15

Read 15 tweets

SophosLabs

@SophosLabs

29 Oct 20

---a thread---

We've discovered that the most recent version of Ryuk shares shellcode with Buer Loader, a malware-as-a-service trojan we've been tracking...

The shellcode is used by droppers for both malware, to inject the malware into memory.

Ryuk in-memory loader:

1/6

Buer Loader in-memory loader:

2/6

Ryuk also recently started encrypting text strings—on October 4, the strings within the sample were unencrypted...

3/6

Read 6 tweets

SophosLabs

@SophosLabs

21 Oct 20

NEW: LockBit uses automated attack tools to identify tasty targets 🎯

Using renamed copies of PowerShell and Windows’VBscript host and scripts based on PowerShell pen-testing tool, LockBit actors searched for systems with valuable data to hit at small organizations...

1/12

A series of recent attacks detected by Sophos provided us the opportunity to dive deeper into LockBit’s tools, techniques & practices.

Based on some artifacts, we believe that some components of the attack were based on PowerShell Empire.

2/12

The organizations hit in the 8 attacks we analyzed were smaller orgs with only partial malware protection deployed. None of them had public Internet facing systems on their networks, though 1 had an older firewall with ports open for remote administration by HTTP and HTTPS.

3/12

Read 12 tweets

SophosLabs

@SophosLabs

12 Aug 20

#Dharma, a family of ransomware first spotted in 2016, continues to be a threat to many organizations— especially small and medium-sized businesses.

(a thread... 1/4)

Part of the reason for its longevity is that its variants have become the basis for ransomware-as-a-service (RaaS) operations—the fast-food franchise of cybercrime.

(2/4)

Three recent attacks documented by SophosLabs and Sophos MTR have revealed a toolset used by Dharma “affiliates” that explains why attacks from so many different Dharma actors seem so identical, down to the tools and commands they use.

(3/4)

Read 4 tweets

SophosLabs

@SophosLabs

28 Nov 18

1/ The threat actors behind the #SamSam ransomware, now identified by the FBI in an indictment publicized today, pioneered a very specific playbook in their attacks that has inspired a rash of copycats.

Here's a thread that explains their TTP (tactics, techniques & procedures):

2/ In July, we published a report that goes into great detail about the #SamSam TTP, so if this is of interest to you, maybe check it out:

sophos.com/en-us/medialib…

What follows is a summary of some of what we covered in the report

3/ The #SamSam attackers started by conducting surveillance of the victims. They wanted to know if the victims had sufficiently deep pockets to pay the ransom, which over time averaged out to the mid-$30,000 as Bitcoin exchange rates fluctuated.

Read 20 tweets

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!