Makop Ransomware

Original Issue Date:- October 29, 2024

Virus Type:-Ransomware

Severity:- High

It has been reported that Makop ransomware is actively targeting organisations including critical sectors. Makop ransomware encrypts the files on the victim's systems and asks for ransom payment in bitcoin.

Makop is an offshoot of the PHOBOS ransomware variant and operates under an affiliate structure.

Infection Mechanism

Makop Ransomware leverages different techniques to enter organizations' networks and inject the payload. The most common attack vectors include the exploitation of internet-exposed systems having exposed unsecured RDP services, phishing emails carrying malicious attachments (often using unusual file extensions to bypass email scans), torrent websites, malicious advertisements etc.

PowerShell: Downloads and executes a batch script on the impacted systems
NS.exe: Scan the network and search for shared folders
Everything.exe: Search filenames or create file listing
Mouselock.exe: Block mouse inputs
NLBrute.exe: Brute-force RDP credentials
Batch scripts: To disable and delete Volume Shadow Copies
RDP: Move laterally through the environment
mc_hand.exe : Ransomware executable

The threat group is also known to leverage PuTTY, Mimikatz, YDArk, Advanced Port Scanner and PsExec to perform the attacks.

Makop Ransomware uses AES-256 algorithm for encrypting files and typically adds the “.makop” or “.mkp” extension to the encrypted files.

Fig.1 Screenshot of Makop Ransomware GUI (Source: Aon)

Fig.2 Makop encrypted file samples (Source: Cyfirma)

Indicator of Compromise:

Hashes:

2881a2a79b9dde2a036648df3f04996cac0401505af3d67156ceb1a4d9011b7c
f43b86ff363f19f26cc7d80aa64fa0894a264a736ae0abd013d98e344637e4d8
08c9f2ba64a192c0c75fcac51019ee996bf1a617eb66cf04acaa9b8e4a3ea36e
d66bfeb539f4b6f81d0610a128d8a7ebbf559b37df226c5c8b3e04d64c37be0d
4aace7fd7ba4c0eb24454f9bbf161499363ff34fc5c2eb81b982a25cfc0fdd27
c5c28f06fc605a7b68c52713f035f7546a15f0ca19761f96903a55021d62c733
dee9199b48489b9077ea11a57303eda7bd33f5d7bca45415a979bca027e246fd
aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da
3664ff8050ccf9e6d73e197f43e23422dcc5bd738c4c5d90808370bc6dba7868
5566123b7485a9e1e25f06bc695d07ba485866d9cbb9a13460676e980d2dd72a
585829269d87b4b63c3cc4c6d855c0077190c2ae888e1e52aad013e2f1eb652a
50901c4dce9b5674b68da3503240b62561af7d99d21ff30c8ec2f4977feb4485
d453c980cc00eab746f80c8bae57728c1d5bab12970605a7644674ca63f26e0f
e48904c3a631f353f6bf1cd3c2509464c86454db1d29bff26b489ffa563788d9
62f796350dae2c66d9505c47f29569410d520d1cf17e33ef2be5d0a2358fb094
72bbcfca7e495c8a32ee6a88234e55378a535761fd4eb97b50c69bc1dbb3478b
7d4b154e90a8472545d84d7d1ec49888269872c9a8adf3a0411317c8f926f1f5
f43b86ff363f19f26cc7d80aa64fa0894a264a736ae0abd013d98e344637e4d8
bff786ac2f9f89305650d5776dbf1ada6ab229ab87be2c335aedaaf7c438185e
e245f8d129e8eadb00e165c569a14b71
6A58B52B184715583CDA792B56A0A1ED
b69d036d1dcfc5c0657f3a1748608148

Email IDs:

datastore@cyberfear[.]com
back2up@swismail[.]com

File Names:

mc_hand.exe : Ransomware executable
Everything.exe : Search filenames or create file listing
Mouselock.exe : Block mouse inputs
NLBrute.exe: Brute-force RDP credentials

Best Practices and Recommendations:

Maintain offline backups of data, and regularly maintain backup and restoration. This practice will ensure the organization will not be severely interrupted, and have irretrievable data.
Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted) and covers the entire organization’s data infrastructure.
Implement all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts) to have strong, unique passwords.
Implement multi-factor authentication for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.
Consider restricting/disabling command-line and scripting activities and permissions.
Disable unused ports & services. Priortize hardening of internet-facing systems.
Remove unnecessary access to administrative shares.
Use a host-based firewall to only allow connections to administrative shares via server message block (SMB) from a limited set of administrator machines.
Enable protected files in the Windows Operating System to prevent unauthorized changes to critical files.
Disable Remote Desktop Connections, employ least-privileged accounts. Limit users who can log in using Remote Desktop, set an account lockout policy. Ensure proper RDP logging and configuration.
Check regularly for the integrity of the information stored in the databases.
Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems.
Establish Domain-based Message Authentication, Reporting, and Conformance (DMARC), DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
Keep the operating system, software and firmware up-to-date with the latest patches. Prioritize patching known exploited vulnerabilities in internet-facing systems.
Application white listing/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
Maintain updated Antivirus software on all systems.
Don't open attachments in unsolicited emails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs, close out the email and go to the organization's website directly through the browser.
Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
Restrict access using firewalls and allow only to selected remote endpoints, VPN may also be used with a dedicated pool for RDP access.
Use strong authentication protocols, such as Network Level Authentication (NLA) in Windows.
Additional Security measures that may be considered are:

Use RDP Gateways for better management.
Change the listening port for Remote Desktop.
Tunnel Remote Desktop connections through IPSec or SSH.
Two-factor authentication may also be considered for highly critical systems.

If not required consider disabling PowerShell / windows script hosting.
Restrict users' abilities (permissions) to install and run unwanted software applications.
Enable personal firewalls on workstations.
Implement strict External Device (USB drive) usage policy.
Employ data-at-rest and data-in-transit encryption.
Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empanelled auditors. Repeat audits at regular intervals.
Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies.

References: