Silent Ransom Group Uses Fast-Flux DNS to Hide Infrastructure
Summary
Resecurity reports that Silent Ransom Group uses compromised routers and other devices for fast-flux DNS, identifying nodes across 18 countries and 22 ISPs rotating records for two domains linked to the group.
Key points
- Resecurity reports that Silent Ransom Group uses infected routers, modems, gateways, and other IoT or customer-premises devices as fast-flux nodes.
- The report identified nodes in 18 countries and across 22 ISPs.
- The network rotates DNS records for ep6pheij[.]com and business-data-leaks[.]com, domains the article says have been used by the group.
- Fast flux rapidly changes DNS records and rotates IP addresses and name servers to obscure server locations.
- The group is described as using vishing and social engineering to gain remote access, often followed by data theft and extortion without file-encrypting malware.
Article Details
- Event Type
- Silent Ransom Group’s use of a fast-flux network to conceal infrastructure used in attacks.
- Impact
- The group rotates DNS records for two domains through infected routers, modems, gateways, and other IoT and CPE devices. Resecurity identified nodes in 18 countries across multiple regions and spread across 22 ISPs. The group targets law firms and organizations in finance, healthcare, insurance, and hospitality, and is reported to steal data and use extortion rather than typically encrypting files.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | business-data-leaks[.]com | Domain identified as part of the fast-flux infrastructure and known to have been used by Silent Ransom Group. |
| DOMAIN | ep6pheij[.]com | Domain identified as part of the fast-flux infrastructure and known to have been used by Silent Ransom Group. |
MITRE ATT&CK
T1052.001 · Exfiltration over USBThe article reports that operatives insert USB drives into victims’ computers for data exfiltration or malware deployment.T1219 · Remote Access ToolsThe group persuades victims to install remote access software.T1566.004 · Spearphishing VoiceThe group uses voice phishing (vishing) to gain remote access to victims’ environments.T1568.001 · Fast Flux DNSThe group uses fast-flux DNS, rapidly rotating DNS records and IP addresses for its domains.T1656 · ImpersonationGroup members reportedly pose as IT specialists to persuade victims to host screen-sharing sessions and install remote access software.
Threat Actors
Silent Ransom GroupAlso identified as SRG; the group is reported to use vishing, social engineering, fast-flux infrastructure, data theft, and extortion.UNC2686The article says some Silent Ransom Group activities overlap with UNC2686, which it describes as known for BazarCall campaigns and use of TrickBot, Ursnif, and BazarLoader.UNC3753Name used to track Silent Ransom Group, which the article reports conducts vishing, data theft, and extortion.
Malware
BazarLoaderwith those of UNC2686, known for BazarCall campaigns and for the use of TrickBot, Ursnif, and BazarLoader malware.TrickBotof its activities overlapping with those of UNC2686, known for BazarCall campaigns and for the use of TrickBot, Ursnif, and BazarLoader malware.Ursnifactivities overlapping with those of UNC2686, known for BazarCall campaigns and for the use of TrickBot, Ursnif, and BazarLoader malware.
Countries
Industries
financeIn addition to law firms, the ransomware gang was seen targeting finance, healthcare, insurance, and hospitality firms, all of which handle sensitive information.HealthcareIn addition to law firms, the ransomware gang was seen targeting finance, healthcare, insurance, and hospitality firms, all of which handle sensitive information.HospitalityIn addition to law firms, the ransomware gang was seen targeting finance, healthcare, insurance, and hospitality firms, all of which handle sensitive information.InsuranceIn addition to law firms, the ransomware gang was seen targeting finance, healthcare, insurance, and hospitality firms, all of which handle sensitive information.Legal“The SRG’s attacks have had a significant impact on the legal industry.