A Deeper Look at Colossus Ransomware

A Deeper Look at Colossus Ransomware

On September 24, 2021, the ZeroFox Threat Intelligence team discovered a previously unknown ransomware going by the name Colossus. This new ransomware appeared to be building towards the ransom-as-a-service (RaaS) and double-extortion model as many others have before it. The leak site — launched around September 20, 2021 — was short-lived, however. By October 18, 2021, the operators had taken the site offline. To date, ZeroFox has only observed a single victim whose data was never publicly listed for download. With the lack of information available on this new ransomware family, the ZeroFox Threat Intelligence team has reverse engineered the sample to learn more about how it works.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Ensure antivirus and intrusion detection software is up-to-date with all patches and rule sets.
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• Maintain regularly scheduled backup routines, including off-site storage and integrity checks.
• Avoid opening unsolicited attachments and never click suspicious links.
• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Review network logs for potential signs of compromise and data egress.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account.

Details

On September 24, 2021, ZeroFox detected a previously unknown ransomware variant that had been uploaded to Hatching Triage, a malware analysis sandbox service. Dropped ransom notes titled "HOW_TO_RECOVER_FILES.Colossus.txt" gave victims the option to communicate via a victim-specific link on the domain colossus[.]support or to contact them using the provided email address. To access the chat, the victim must enter a private key provided in the note.

Colossus “Hell Page”

Initially, Colossus did not offer a traditional leak site on their domain. Victims were given their own link to a chat with the group, but simply browsing to the domain itself returned an empty page until October 13, 2021. When Colossus finally created their own leak page, it listed only the previously known victim. Links to data were promised as “coming soon,” though this ultimately never happened. ZeroFox observed that on October 15, 2021, the only publicly listed victim had been removed and, just three days later on October 18, 2021, the entire website appeared to be non-functional. While the server was still responding as of this writing, each request now returns HTTP 503 Service Unavailable. A scan of multiple forums known for hosting ransomware-as-a-service operators did not uncover any notable findings, besides general chatter confirming the temporary existence of the leak site.

Figure 1. Colossus leak site as it appeared on October 13, 2021.
Source: ZeroFox Threat Intelligence

Figure 2. Colossus leak site after removing the only publicly listed victim.
Source: ZeroFox Threat Intelligence

Ransomware Analysis

The Colossus sample obtained by ZeroFox is protected with Themida, a well-known packer that can make use of virtualization techniques and anti-sandbox measures to make static binary analysis significantly more challenging. The ransomware itself was created in Golang, also referred to simply as “Go.” Similar to Microsoft’s .NET family of programming languages and Oracle’s Java, it is possible to recover the function names used by threat actors used in the source code. While many actors have caught on to this and use tools to obfuscate function names, Go-specific functions and third-party dependencies are left untouched by obfuscation tools. Even if function names are obfuscated, it becomes easy to separate code the analyst is interested in from the potentially hundreds of other functions generated by the Go runtime.

Figure 3. Colossus ransomware function names after obfuscation.
Source: ZeroFox Threat Intelligence

The first step taken by Colossus is to decrypt its configuration. Several items decrypted at this stage are used later to build the ransom note, such as the group’s email address, victim-specific negotiation URL and the ransom note template itself. Each of the configuration items are decrypted nine times through three similar functions that must be called in a specific order.

Figure 4. Colossus decrypting the actor’s email and victim-specific negotiation URL.
Source: ZeroFox Threat Intelligence

While decrypting these configuration items used later for the ransom note, Colossus also decrypts a value it expects to be passed via the command line. If this value is not passed as the first argument, the sample will simply exit without encrypting any files. This has been seen in other ransomware families such as Egregor and may be used to prevent execution in sandbox environments.

Next, Colossus replaces placeholder values in its ransom note template with the values decrypted earlier. Then, it checks for a path to encrypt being passed as the second command line argument. If both of these conditions have been met, the ransom note is then written to that directory and it begins to search for all files in that path. This directory is also checked recursively, meaning any sub-directories will also be encrypted.

Figure 5. A portion of the Colossus ransom note template showing placeholder values.
Source: ZeroFox Threat Intelligence

When searching for files to encrypt, the only criteria checked against is that the text “.Colossus” does not exist anywhere within the file name. Most ransomware families use a list of file extensions to specifically include or exclude from encryption. A careless operator or affiliate running the ransomware from a higher level directory such as the User profile or drive root could cause system instability if they run the ransomware as an administrator.

Figure 6. Colossus decrypts text (“.Colossus” in this instance) to search for in file names.
Source: ZeroFox Threat Intelligence

For each file encrypted by Colossus, a key is randomly generated in four parts. These are then combined into one key before also being encrypted independently using RSA with Optimal Asymmetric Encryption Padding (OAEP).

Figure 7. Colossus file key generation and key protection.
Source: ZeroFox Threat Intelligence

Before encryption, every file is also checked to see if it exceeds a certain size. In this case, the set file size was 1 million bytes, or, roughly 1 megabyte. Encrypting only a set amount of bytes is a common tactic used by actors to speed up the encryption process and finish processing all files before the running process is killed. Only targeting the first so many bytes of a file may also be seen as “good enough” if it effectively corrupts the file to the point that it cannot be used by the victim. To perform the encryption, Colossus opts for a simple XOR routine rather than relying on the previously used AES or RSA encryption methods. The independently encrypted key parts from before are then appended one at a time to the end of the file. Finally, the file is renamed with the configured extension, a processed file counter is increased, and the loop continues.

Figure 8. Colossus will XOR roughly 1 megabyte of data from the start of each file.
Source: ZeroFox Threat Intelligence

Conclusion

In its current state, Colossus appears to be a new and fairly simple ransomware variant. Basic features typically seen in other families such as file extensions to target are not present in this build and the sample obtained by ZeroFox did not always wait for every file to be processed before exiting, which may lead to potential data loss for victims. While ransomware families disappear and reappear — sometimes with a new identity — all the time, it remains unclear whether Colossus’ quick exit means it has disappeared for good.

Indicators of Compromise

Domains

• colossus[.]support

SHA256 Hashes

• b70b9039ec4b33987a991c5c20729eb3310d7406b8d15161037df3b21fd968bb