Increase of new Ransomware products in wake of Colonial Pipeline incident

Increase of new Ransomware products in wake of Colonial Pipeline incident

Since the recent Colonial Pipeline incident, and the introduction of additional powers and US laws targeting cybercriminals, popular Ransomware-as-a-Service (RaaS) schemes have drastically changed their operating model. Many programs have now moved to private or closed access programs, only allowing vouched affiliates to be able to purchase and use their ransomware. In the wake of these changes, ZeroFOX has observed multiple new RaaS offerings being posted to deep and dark web underground forums, offering cheap, open access to new ransomware programs and affiliate schemes from authors looking to fill the gap created in this market.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Ensure antivirus and intrusion detection software is up-to-date with all patches and rule sets
• Segment critical network resources using zero-trust configurations
• Maintain regularly scheduled backup routines, including off-site storage and integrity checks
• Limit file egress by size and type
• Disable macros whenever possible
• Avoid opening unsolicited attachments and never click suspicious links
• Enable 2-factor authentication for all of your organizational accounts
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

During the advent of ransomware, variants such as "BitLocker" were purely designed to infect, spread, and encrypt a network and its assets. Once complete, a ransom would be requested in the form of digital currency in order to restore and decrypt the victims files. However, over the course of 2020-2021 there has been a shift in tactics being utilised by ransomware operators. Popular ransomware and RaaS products currently include extra capabilities to evade detection, increase impact, and exfiltrate victim data. This has a compounding effect on the victim in that not only must a ransom be paid to restore their files, but also if they fail to pay, their files will be sold or "leaked" to the public.
This type of tactic has paid dividends for ransomware operators, allowing them to bring in over $350 million in 2020.

Alongside the authors of ransomware however, are a string of additional operators and users of their software. This can range from affiliates, resellers, and access brokers which will sell credentials or direct access to a company, in order for ransomware to be deployed. These associates will generally be given a portion of the ransom payment if successful.

Since the recent ransomware attack on Colonial Pipeline, many popular RaaS products have shifted to a closed access model, where new affiliates must be vouched for by an existing affiliate. Authors have also placed bans on affiliates targeting certain geographical locations or verticals, in an effort to reduce the potential for being targeted by law enforcement.

Figure 1: REvil post on a popular Russain criminal forum, announcing ban on affiliates targeting specific industries.

However, in response, less scrupulous malware authors have taken the opportunity to begin creating, advertising, and selling new Ransomware-as-a-Service offerings in order to fill the gap created in the RaaS market. ZeroFOX has observed several new RaaS affiliate schemes and authors offering their services on criminal marketplaces and forums, some specifically calling out the recent events as their motivation.

Camelvalley Ransomware

#1Today, 09:37 AM
Since the Colonial Pipeline cyberattack, there are only few ransomwares out there. All RaaS went private only. And the Locker discussion has been banned nearly everywhere. Except there. So, i'll propose you a deal you can't refuse!
The Camelvalley Ransomware comes out with plenty of interesting features, and even a solid Anti-Ransomware protection bypass that makes your cyberattack even more easier. The main goal of this project is to let you use less time on working on the ransomware itself and focus more on the evasion and hacking.

What we offer you:

-Multithreaded encryption and Memory Mapped Files
-Rsa 2048+ChaCha20 encryption
-Configurable Mutex Name, Ransom Note, and Extension.
-Dynamic and Static evasion
-RIPlace to bypass ransomware protection
-Automatic spreading(may not always work)
-Shadowcopies deletion.
-Each build is different.

Each build: 150 USD.

You're an experienced seller? You're welcome!

We agree on reselling. If you can sell your product in other places, to other people, we can offer you a discount. But you should prove yourself an experienced seller.

Figure 2: Screenshot and text from "Camelvalley Ransomware" author

In the above post from an underground forum aimed at the selling and distribution of malware, the actor claims the main goal of his project for users is "less time on working on the ransomware itself and focus more on the evasion and hacking". The actor is willing to sell each build of the ransomware for $150, and is accepting resellers. The same author has been seen on multiple forums offering to sell their ransomware product.

M3rcury - FUD advanced ransomware

The M3rcury ransomware is a ransomware written entirely from scratch, which uses a unique multi-pass piecewise encryption mechanism for evade anti-ransomware

Features
Removal of backups
Hybrid RSA AES-256 encryption
UAC bypass
Sandbox Detection
Evasion of heuristic analysis
Heavy obfscuation
Scantime packed and crypted
Encryption mechanism to defeat anti-ransomware detection
Working on windows 7/10

Encryption mechanism:
M3rcury goes through all files on the system and encrypts only part of them. Then it goes through all files again and again until all are fully encrypted. This is useful for evading anti-ransomware because it will have encrypted many more files before detected as opposed to a traditional ransomware. It also causes more damage faster as critical information of a file is often near the header.

What you will recieve
Attacker side decryption source code written in golang
Copy of the main ransomware executable in both 32 and 64 bit
Your unique private key for victim decryption
Access to all future updates!

Note: This is not RaaS you recieve 100% of your ransoms! Smile

Payload size is 1.7 MB

Pricing
€ 170 / $ 207

Accept Monero and BTC but Monero is alot preferred

You can contact us via PM or [REDACTED]

Please use our PGP key to communicate

Figure 3: Screenshot and text from "M3rcury Ransomware" author

Many ransomware authors try to differentiate their offering based on attributes of their ransomware product, and if it is "FUD" (Fully UnDetected). Not all operators follow the Ransomware-as-a-Service model either, instead opting for one time payments and not taking any portion of the ransom payments.

As more popular ransomware and RaaS offerings begin to close their doors to new affiliates and users, ZeroFOX assesses with HIGH likelihood that an increasing number of malware authors will continue to develop new ransomware products in order to fulfil the demand for low cost, easy access ransomware programs.