Can You See It Now? An Emerging LockBit Campaign

FortiGuard Labs has observed a new LockBit ransomware campaign during last December and January using a combination of techniques effective against AV and EDR solutions. LockBit has been one of the more dangerous ransomware, active since 2019. It was part of several successful attacks against a large variety of industries, including critical infrastructure.

This blog post discusses the infection chain and Tactics, Techniques, and Procedures (TTPs) of this campaign.

Overview

Descriptions of the attack refer to the stages outlined in Figure 1 below. The attack starts with a .img container (1) and a social engineering technique of displaying a single file once it’s mounted while hiding the rest of its files from the user. It can also cause malware analysts to miss the payloads while examining the samples manually.

The user is then prompted to open the single visible shortcut (2) file.

In some of the cases that we’ve observed, a python script is executed (2.1) using the official Python embed package. The only purpose of the script is to run the subsequent BAT scripts. Some variants used a known UAC bypass method abusing the legitimate fodhelper.exe (3.1). This enables the attacker’s BAT file to run in a new elevated process without the user’s approval.

The BAT script (4) does several things:

1.     Changes the password of the logged-in user.

2.     Copies its files to C:\ProgramData.

3.     Ensures that after the system reboots, it logs in without user interaction (using SysInternals Autologon).

4.     Tries to -

a.     Set the next reboot to be in Safe Mode using bcdedit.exe.

b.     Register a new service that will run its VBS script (4.1) using sc.exe.

c.      Sets the service to run also in Safe-Mode using reg.exe.

5.     If it fails, it sets in the registry a BAT file (4.2) to be run on logon as another UI shell by Winlogon.

6.     Reboots the machine.

The ransomware executable resides within a password-protected archive. The script that runs after boot executes another BAT script (4.3) to extract the ransomware payload. It uses the 7-zip archiver and then runs it with a ‘-pass’ argument that is needed for the malicious executable to unpack itself.

The final payload is LockBit. Analysts from TrendMicro have published an analysis of the ransomware.

Targeting focuses on Spanish-speaking victims – all samples target Mexican or Spanish firms, mainly in the consulting and law sectors.

Ransomware note:

Your data are stolen and encrypted

The data will be published on TOR website if you do not pay the ransom

You can contact us and decrypt one file for free on this TOR site

(you should download and install TOR browser first https://torproject.org)

http://<onion address>

Your company id for log in: <unique id>

Evasive Tradecraft

The detection rate of the samples in VirusTotal was a minimal single digit, with some completely undetected, suggesting the campaign’s methods are effective in defense evasion.

Delivery through a .img container bypasses the Mark of The Web (MOTW) protection mechanism. Multi-stage scripts that extract a password-protected ransomware executable, which is unpacked only when run with a unique password, allow evading traditional signature-based detection.

The malware authors have shown a creative and wide-ranging usage of signed, legitimate executables: the mounting of .img files by Windows Explorer, python execution by a signed interpreter, the extraction of encrypted archives by 7-zip, and automatic log-in using Sysinternals’ Autologon. This allows for minimal reliance on custom code, trimming development costs, and staying under the radar of EDRs.

Summary

This campaign’s highly evasive nature demonstrates that attackers continue to leverage increasingly obscure methodologies to avoid detection. This unique combination of executables wasn’t seen in previous LockBit attacks.

These payloads may be related to the LockBit builder leak in late 2022. Hence, a definitive attribution to the original group behind LockBit, or its affiliates, may be difficult. Other cybercriminals would want to associate themselves with the deterrence already afforded by past acts of LockBit.

Fortinet Solutions

FortiEDR detects and blocks these threats out of the box without any prior knowledge or special configuration. It does this using its post-execution prevention engine to identify malicious activities:

All network IOCs have been added to the FortiGuard WebFilter blocklist.

FortiGuard Antivirus has coverage in place as follows:

W32/Lockbit.K!tr.ransom

The FortiGuard Antivirus service engine is included in Fortinet’s FortiGate, FortiMail, FortiClient, and FortiEDR solutions.

In addition, as part of our membership in the Cyber Threat Alliance, details of this threat were shared in real-time with other Alliance members to help create better protections for customers.

Learn more about Fortinet’s FortiGuard Labs threat research and intelligence organization and the FortiGuard AI-powered security services portfolio. If you think this or any other cybersecurity threat has impacted your organization, contact our Global FortiGuard Incident Response Team.

Appendix A: MITRE ATT&CK Tactics and Techniques

APPENDIX B: IoCs

IMG SHA256

1ef3ae251833be08b6f3e525969ae02c28cb0238e3adb3091e572a10633f7ef7
dad61d9f919a9cc84ae633e948946e7546b21dc4d9d47d19d96fd308c7de40cb
d73bcd2e29191b260a26d87c3035bde33163cc319649291db9f04c48c94da896
ee2b182a56ded459a113513985ff624631a9515c7efa2282708483ace640eb3a
dca325a0028dc8e41dcf739cd00701a19066fc88c0d22be5316f7a4b7b219fe8
35bf036bf46fa21f3354d60a2c50d2959e1e9193bec8364575dc3fd4644732ae
781ead305cdb5fa0153369431dedd40fe138308fcdf5dfda1cfeaaba296752e3
1ef3ae251833be08b6f3e525969ae02c28cb0238e3adb3091e572a10633f7ef7
dad61d9f919a9cc84ae633e948946e7546b21dc4d9d47d19d96fd308c7de40cb
d73bcd2e29191b260a26d87c3035bde33163cc319649291db9f04c48c94da896
ee2b182a56ded459a113513985ff624631a9515c7efa2282708483ace640eb3a
dca325a0028dc8e41dcf739cd00701a19066fc88c0d22be5316f7a4b7b219fe8
35bf036bf46fa21f3354d60a2c50d2959e1e9193bec8364575dc3fd4644732ae
781ead305cdb5fa0153369431dedd40fe138308fcdf5dfda1cfeaaba296752e3
1858a862390adcaa4cea6782e7dba077697475ff9ada9d75c4897ccd563998af

Ransomware Executables

Domains

poliovocalist[.]com

IPs

198.244.187[.]248

150.129.218[.]231

LockBit Portal URLs

hxxp://lockbit3jx6je7tm6hhm6zzafgy6hpil3ur6jmc2a4ugan7xzztv6oqd[.]onion

hxxp://lockbitdvbpfczc3yrs37kpp6avnrgr7yygi2f45qxvef2yqi36lpxyd[.]onion

hxxp://lockbit3hc6syym13ki2ag5jskr6q5qa3spspjpmtfhh6fufut737zid[.]onion

hxxp://lockbitov3afmxgknfhk2o5d4uqrhygd7ty3xqm56qd6zjlu6u43pgyd[.]onion