Investigations by Symantec into Ryuk and Conti ransomware attacks found significant overlap in tools used to deliver both, supporting reports that there is likely some affiliation between the two. Recent attacks have involved extensive use of variants of Cobalt Strike. In some cases, the infection vector appears to be via IcedID malware, which delivers malware known as Longlist, which in turn is used to install Cobalt Strike.
Table of Contents
Activity to Note Is:
- Cobalt Strike executed with this command:
- Use of WMIC to execute Cobalt Strike on other computers in the network: CSIDL_SYSTEM\cmd.exe /C wmic /node:[REDACTED] /user:<?,?> /password:<?,?> process call create ‘cmd.exe /c regsvr32.exe CSIDL_COMMON_APPDATA\tstdll.dll 11985756’
- Cobalt Strike executed with this command: RunDll32 CSIDL_PROFILE\documents\werfault.dll,tstsec 11985756
- Presence of credential stealer LaZagne in this path: csidl_windows\temp\gtt654f
- Presence of Adfind in this path: csidl_windows\temp\adf
Targets of Ryuk and Conti Ransomware Attacks
These tools have been used in targeted ransomware attacks, which tend to be concentrated against medium-to-large-sized organizations in:
- North America
Tools Used in Ryuk and Conti Ransomware Attacks
The attackers have used a combination of custom malware, off-the-shelf tools, and living off the land tactics.
- Cobalt Strike
Organizations should review this alert and scan their network for associated indicators of compromise (IOCs). Their presence may indicate a ransomware attack in preparation.
Indicators of Compromise (IOCs) Of Ryuk and Conti Ransomware Attacks:
477b49df42b2cd2805fcffa8de2dd14d732628e1e1c2132cb22b8687ee9312d3 Cobalt Strike
e49ff404012f54f6fdafd8dc301b0c03722e17a8b394f8187946c7d2b4dd7110 Cobalt Strike
34591bb2484145360ec3af5c0fc5e364304f0c252890ac6fafad76ac3155185a Cobalt Strike
a16189ede9b4b2240654e38ccc5c4d386c37b4375f1c7ad752a5c8ba0f770232 Cobalt Strike
0f9e1390cb0b51a68e2c60b7dd7fcd79d3344db680721b2bbde0865e60269e28 host.exe (unknown tool)
b3ae259df698576d682af6d00ba89a2182f00c02406589fe4dda5f4d8f621e03 run.exe (unknown tool)
95548e4075dda4b11bbe5be359d5612f3e61e1b71c717ddb18225737bcada8dd Unknown tool
Thanks for visiting our site. Please share this advisory to others to protect them from being the victim of this attack.