Despite active attacks by gangs such as the NoName ransomware group, which has targeted small and medium-sized businesses worldwide for the past three years, the group has continued to grow by using custom malware and evolving its attack methods.
A recent link pointing to NoName has led to the conclusion that the group is no longer independent, but is now affiliated with RansomHub. As a result of this development, cyber security levels worldwide are in danger, especially for small and medium-sized businesses.
A new affiliate has now joined extortion group RansomHub, an up-and-coming online criminal extortion group, and its main claim to fame so far has been impersonating LockBit ransomware-as-a-service, which is based out of the Netherlands. It has been well-documented that NoName exploits vulnerabilities that date back many years.
Over the last three years, it has been well documented that the NoName ransomware gang, also known as CosmicBeetle, has been creating waves worldwide by targeting small and medium-sized businesses. Recent observations have shown that the gang is making use of a new type of malware called RansomHub to carry out its crimes. For gaining access to networks, the gang uses a variety of custom tools, including those from the Spacecolon malware family, which it acquired from cybercriminals.
A number of the tools that are used to distribute these tools use brute force methods to deploy them and exploit known vulnerabilities such as EternalBlue (CVE-2017-0144) and ZeroLogon (CVE-2020-1473).
In recent attacks, the NoName gang has been using the ScRansom ransomware to encrypt documents and digital files, replacing the Scarab encryptor that it had previously used.
Additionally, the gang has already begun experimenting with the leaked LockBit 3.0 ransomware builder, creating a similar site for leaking data and issuing similar ransom notes based on the design of the released code.
A cybersecurity company called ESET has been tracking the activities of the NoName gang since 2023, which is almost four years ago. Even though ScRansom is less sophisticated than other ransomware threats, but still poses a significant threat to the operating system, it has been observed to develop and become more sophisticated over time.
Several aspects of ScRansom are complex, including AES-CTR-128 encryption and RSA-1024 decryption, causing problems when decrypting the files sometimes. It has been reported that victims received multiple decryption keys but are still unable to recover all the files they lost.
ScRansom allows attackers to take advantage of different speed modes for partial encryption, allowing them flexibility.
A 'ERASE' mode can be also operated to replace the contents of the file with a constant value, thereby ensuring that the contents cannot be recovered. With ScRansom, file encryption is possible across all drives and the operator can decide what file extensions to encrypt, and what folders they want to encrypt. ScRansom kills several processes and services on the Windows host before the encryptor fires. These include Windows Defender, the Volume Shadow Copy service, SVCHost, RDPclip, and LSASS, as well as processes related to VMware tools.
There are several encryption schemes used by ScRansom to protect the public key, and one of them is AES-CTR-128 which is combined with RSA-1024 to generate an extra AES key for security reasons.
As a result of the multi-step process, there are times when errors occur in this process that can lead to the failure of the decryption process. As a result of executing the ransomware on the same device a second time, or in a network with multiple systems running different versions of the virus, new sets of unique keys will be generated for every victim, making the entire decryption process rather difficult to perform.
Furthermore, in addition to brute force attacks that are used by the NoName gang to gain access to networks, several other vulnerabilities are exploited by them that are common in SMB environments. CVE-2017-0144 (also known as EternalBlue), CVE-2023-27532 (a vulnerability in Veeam Backup & Replication), CVE-2021-42278 and CVE-2021-42287 (AD privilege escalation vulnerabilities) through noPac, CVE-2022-42475 (a vulnerability in FortiOS SSL-VPN), and CVE-2020-1472 (also known as Zerologon) are some of the vulnerabilities.
With ScRansom's file encryption capabilities, it can encrypt files on all types of drives, including fixed, remote, removable, and cloud storage, and allows users to personalize the list of file extensions they wish to encrypt.
When ESET researchers were investigating a ransomware attack that began with a failed ScRansom deployment in early June, they discovered that the threat actor executed on the same machine less than a week later.
The EDR killer tool, which provides privilege escalation and the ability to disable security agents by deploying legitimate and vulnerable drivers on targeted computers, was a tool that was released by RansomHub shortly after.
The compromised computer was ransomware-encrypted two days later, on June 10, by the hackers who used the RansomHub ransomware.
There was an interesting way of extracting the EDR killer described by the researchers, one that was characteristic of CosmicBeetle rather than RansomHub's affiliates.
It was noted that there has been no leak in the past of the RansomHub code and its builder, so ESET researchers were "pretty confident" that CosmicBeetle was enrolled as a new RansomHub affiliate.
Even though ESET does not claim to have any affiliation with RansomHub, they do state that the Ransom Encrypter is being actively developed by their engineers.
