RansomHub Ransomware

Original Issue Date:- October 29, 2024

Virus Type:-Ransomware

Severity:- High

It has been reported that RansomHub ransomware is aggressively targeting enterprises with double extortion attacks causing data exfiltration and encryption. RansomHub, operating as a Ransomware-as-a-Service (RaaS) is believed to be a rebranded version of Knight/Cyclops ransomware. The group focuses on the systems based on Windows, Linux, ESXi, NAS, and SFTP servers for attacks.

Infection Mechanism

RansomHub group typically compromises internet facing systems and user endpoints by using methods such as exploitation of known vulnerabilities, phishing emails, and password spraying.

Once inside the network, RansomHub affiliates use various tools to execute attacks, including EDRKillShifter, TDSSKiller, BITSAdmin, Cobalt Strike, Mimikatz, PSExec, PowerShell, RClone, Sliver, SMBExec, WinSCP, CrackMapExec, Kerberoast, and AngryIPScanner.

RansomHub ransomware typically leverages Elliptic Curve Encryption algorithm called Curve 25519 to encrypt accessible files on the systems and networked shares.

Fig.1 Infection chain of the RansomHub (Source: TrendMicro)

Fig.2 RansomHub command-line help menu (Source: Symantec)

Indicator of Compromise:

Hashes:

02e9f0fbb7f3acea4fcf155dc7813e15c1c8d1c77c3ae31252720a9fa7454292
34e479181419efd0c00266bef0210f267beaa92116e18f33854ca420f65e2087
7539bd88d9bb42d280673b573fc0f5783f32db559c564b95ae33d720d9034f5a
8f59b4f0f53031c555ef7b2738d3a94ed73568504e6c07aa1f3fa3f1fd786de7
ea9f0bd64a3ef44fe80ce1a25c387b562a6b87c4d202f24953c3d9204386cf00
104b22a45e4166a5473c9db924394e1fe681ef374970ed112edd089c4c8b83f2
2f3d82f7f8bd9ff2f145f9927be1ab16f8d7d61400083930e36b6b9ac5bbe2ad
36e5be9ed3ec960b40b5a9b07ba8e15d4d24ca6cd51607df21ac08cda55a5a8e
595cd80f8c84bc443eff619add01b86b8839097621cdd148f30e7e2214f2c8cb
7114288232e469ff368418005049cf9653fe5c1cdcfcd63d668c558b0a3470f2
e654ef69635ab6a2c569b3f8059b06aee4bce937afb275ad4ec77c0e4a712f23
fb9f9734d7966d6bc15cce5150abb63aadd4223924800f0b90dc07a311fb0a7e
f1a6e08a5fd013f96facc4bb0d8dfb6940683f5bdfc161bd3a1de8189dea26d3
a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b
56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763
60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e
30abbbeedeeb268435899a7697f7a72f37a38e60ae2430e09bc029c7a8aa7001
869758de8334c2b201a07cfbfc0a903105a113080dde0355857de46b3eaae08e
bfbbba7d18be1aa2e85390fa69a761302756ee9348b7343af6f42f3b5d0a939c
490a7515445c2ebf8dfbe3791383ac050cd7fca5dcf0c4539f276ad21aa1afe7
7539bd88d9bb42d280673b573fc0f5783f32db559c564b95ae33d720d9034f5a
50d4a24a25be1e16b7805c6aff4436bae13623c5e26658871863875b2960771d
f6c47853c53254342416263ea39715e44374be7627697f41788ab789a307f77e
a0b3beae5a411b930ea3782fb708681ab2ad8d4806794ab594cbfe306a123e52
74fc8bd52429e23c863d9b407314e56eb88936f4028aab7564dea3cbf64c9aa7
f6663774f9e46cb408c6865f725b27dcb314efbf5c9f3191484caeed32ead66f
a7278ec4b2e2e1f6aacfe121dfb184603046f4f046e36a0c08d6044ed6a233c8
b0d6a5e9949bf94cc9bf229a1edbb17136ea858b0ad7410676e6913966425302
cfb787837a5563f91cfdaad054afd0b01524acb5208ebaf804c50e5b7e565741
2d823c8b6076e932d696e8cb8a2c5c5df6d392526cba8e39b64c43635f683009
467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486

IP Addresses:

8.211.2[.]97
45.95.67[.]41
45.134.140[.]69
45.135.232[.]2
89.23.96[.]203
188.34.188[.]7
193.106.175[.]107
193.124.125[.]78
193.233.254[.]21

For additional IOCs pertaining to RansomHub ransomware, kindly refer URLs:

Best Practices and Recommendations:

Maintain offline backups of data, and regularly maintain backup and restoration. This practice will ensure the organization will not be severely interrupted, and have irretrievable data.
Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted) and covers the entire organization’s data infrastructure.
Implement all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts) to have strong, unique passwords.
Implement multi-factor authentication for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.
Consider restricting/disabling command-line and scripting activities and permissions.
Disable unused ports & services. Priortize hardening of internet-facing systems.
Remove unnecessary access to administrative shares.
Use a host-based firewall to only allow connections to administrative shares via server message block (SMB) from a limited set of administrator machines.
Enable protected files in the Windows Operating System to prevent unauthorized changes to critical files.
Disable Remote Desktop Connections, employ least-privileged accounts. Limit users who can log in using Remote Desktop, set an account lockout policy. Ensure proper RDP logging and configuration.
Check regularly for the integrity of the information stored in the databases.
Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems.
Establish Domain-based Message Authentication, Reporting, and Conformance (DMARC), DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
Keep the operating system, software and firmware up-to-date with the latest patches. Prioritize patching known exploited vulnerabilities in internet-facing systems.
Application white listing/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
Maintain updated Antivirus software on all systems.
Don't open attachments in unsolicited emails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs, close out the email and go to the organization's website directly through the browser.
Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
Restrict access using firewalls and allow only to selected remote endpoints, VPN may also be used with a dedicated pool for RDP access.
Use strong authentication protocols, such as Network Level Authentication (NLA) in Windows.
Additional Security measures that may be considered are:

Use RDP Gateways for better management.
Change the listening port for Remote Desktop.
Tunnel Remote Desktop connections through IPSec or SSH.
Two-factor authentication may also be considered for highly critical systems.

If not required consider disabling PowerShell / windows script hosting.
Restrict users' abilities (permissions) to install and run unwanted software applications.
Enable personal firewalls on workstations.
Implement strict External Device (USB drive) usage policy.
Employ data-at-rest and data-in-transit encryption.
Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empanelled auditors. Repeat audits at regular intervals.
Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies.

References: