REvil/Sodinokibi Ransomware
OVERVIEW
The REvil/Sodinokibi threat group has taken ransomware attacks to a new level. While most variants, like the recent strain of DoppelPaymer ransomware, encrypt victim’s files, Proficio’s Threat Intelligence Team has seen an uptick of strains that also steal data to further pressure victims into paying ransoms. This group, infamously known as the one claiming to have obtained President Donald Trump’s legal documents, more recently attacked the law firm Grubman Shire Meiselas & Sacks (GSMLaw) which resulted in the exfiltration of multiple celebrities’ legal documents.
In this blog, we will be sharing additional details we discovered based on our research on the REvil/Sodinokibi ransomware.
RANSOMWARE DETAILS
REvil/Sodinokibi ransomware was discovered back in April 2019, where it was initially found to propagate via exploitation of a vulnerability in Oracle WebLogic. REvil/Sodinokibi is a ransomware-as-a-service (RaaS) and was suspected to be associated with GandCrab, a RaaS that had shut down operations in May 2019. REvil/Sodinokibi was found to share similar codes with GandCrab ransomware, such as the random URL generation.
Within the past year, REvil/Sodinokibi threat actors have been observed to utilize multiple techniques to spread ransomware to targets. Based on our research, some of distribution methods used are:
- Oracle WebLogic vulnerability (CVE-2019-2725)
- Malspam campaigns
- Hack WordPress sites and fake forum posts containing a link to the ransomware installer
- Breach managed service providers (MSPs) via exposed RDP
- Webroot SecureAnywhere console in MSPs that deploys ransomware on the MSPs’ customers systems
- RIG exploit kit
- Pulse Secure VPN vulnerability (CVE-2019-11510)
Once the ransomware is delivered to a victim device, it can perform the following tasks:
- Exploit the CVE-2018-8453 vulnerability to elevate privileges
- Terminate blacklisted processes prior to encryption to eliminate resource conflicts
- Wipe the contents of blacklisted folders
- Encrypt non-whitelisted files and folders on local storage devices and network shares
- Exfiltrate basic host information
Upon successful encryption of the victim’s files, the ransomware appends a randomly generated file extension to the file name made up of 5 to 10 alphanumeric characters. A ransom note is dropped onto the victim’s device with instructions on how the victim can pay the ransom.
REvil/Sodinokibi threat actors usually provide two methods of payment. The first method is to access a Tor site using a Tor browser; the other is to use their secondary website. Earlier attacks provided “decryptor[.]top” as their secondary payment site, however more recent attacks appear to have switched to “decryptor[.]cc” instead.
Since January 2020, the threat actors behind the REvil/Sodinokibi ransomware have started to publish data stolen from victims that did not pay their ransom on time. This method of pressuring victims was inspired by Maze ransomware, which started this trend among ransomwares.
ADDITIONAL ACTIONS BY THE THREAT INTELLIGENCE TEAM
PRECAUTIONARY AND DETECTION MEASURES
Prevention is better than a cure, and given the popularity of ransomware attacks, you always need to be prepared. When possible, you must safeguard yourself and your organization to avoid being the next victim of ransomware attacks. We recommendthe use of a managed EDR service to help you deal with any ransomware attack quickly.
We also recommend organizations consider the following measures:
- Keep your anti-virus software / EDR solutions and other security tools update to date to provide detection and prevention from the spread of ransomware.
- Make use of managed EDR services to quickly react and contain any ransomware identified before any major damage can be done.
- Managed EDR services can also play a big part in monitoring and alerting on attack vectors that are often used as distribution methods for ransomware.
- Perform regular backups on critical files and systems.
- Keep your operating systems up to date with the latest security patches.
- Make use of network segmentation alongside the zero-trust model.
- Close any unnecessary network ports to reduce entry points for attackers.
- Apply content filters on email gateways and email systems to prevent malicious content from reaching users and reduce the chance of a possible compromise.
- Educate your employees and users to improve cybersecurity awareness.
REFERENCES
- https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html
- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-distributed-by-hackers-posing-as-german-bsi/
- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-spreads-via-fake-forums-on-hacked-sites/
- https://www.zdnet.com/article/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems/
- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-targeting-asia-via-the-rig-exploit-kit/
- https://www.zdnet.com/article/vpn-warning-revil-ransomware-targets-unpatched-pulse-secure-vpn-servers/
- https://www.secureworks.com/research/revil-sodinokibi-ransomware
- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-publishes-stolen-data-for-the-first-time/
- https://www.bleepingcomputer.com/news/security/shared-code-links-sodinokibi-to-gandcrab-minus-the-fun-and-games/
- https://blog.redteam.pl/2020/05/sodinokibi-revil-ransomware.html?m=1
- https://www.pcrisk.com/removal-guides/14942-sodinokibi-ransomware
