Talos Details MedusaLocker Affiliate Using BabyLockerKZ Since 2022
Summary
Talos links a financially motivated actor active since at least 2022 to BabyLockerKZ, a MedusaLocker variant, and details its credential-theft and lateral-movement tools, targeting patterns, and detection indicators.
Key points
- Talos assesses with medium confidence that the actor is financially motivated and may work as an initial access broker or ransomware affiliate.
- The group has targeted organizations worldwide since at least October 2022; its observed focus shifted from Europe toward Latin America in 2023.
- The actor deployed BabyLockerKZ, a MedusaLocker variant with distinct registry keys and an autorun entry, while retaining the same chat and leak-site URLs as MedusaLocker.
- Custom tools named Checker, PTH, and MIMIK automate credential handling and lateral movement, including pass-the-hash activity and credential theft.
- The actor also used public tools including Mimikatz, network scanners, and software intended to disable antivirus and endpoint detection.
- Talos provides indicators of compromise and lists Snort and ClamAV detections, along with Cisco security-product coverage.
Article Details
- Attack Vectors
- The actor used BabyLockerKZ, a MedusaLocker ransomware variant, to encrypt victims' systems.
- The actor used tools including Mimikatz and wrappers to steal credentials, and Checker to test credentials and support lateral movement over SMB, WMI, PSEXEC, and RDP.
- The actor used pass-the-hash techniques with NTLM hashes for remote authentication over SMB and WMI.
- The actor stored attack tools in Music, Pictures, or Documents folders and other paths on compromised systems.
- The MIMIK wrapper could upload stolen credentials to an attacker-controlled server; the article does not identify that server.
- The actor used tools to disable antivirus and endpoint detection and response software.
- Defensive Notes
- The article recommends detection and blocking through Cisco Secure Endpoint, Secure Web Appliance, Secure Email, Secure Firewall, Secure Network/Cloud Analytics, Secure Malware Analytics, Umbrella, and Cisco Duo.
- Keep Snort Subscriber Rule Set and ClamAV detections up to date; the article lists Snort rule SIDs and ClamAV detection names.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 012657c4548d9c98223caa4cc7aa52fc083d6983d42fde16ca3271412e7fe3fe | Hash listed as a BabyLockerKZ ransomware sample. |
| SHA256 | 1e9246e6a35731143368eaa0ade4f3cf576d6b22e6090152f6e94f1fa3070651 | Hash listed for the Checker tool. |
| SHA256 | 1f2df15442593b159e45d16a27e4d43d3a9062da212a588ba4c048f214a0b7be | Hash listed for the Checker tool. |
| SHA256 | 270c3354b3ee2940b499e365eaba143fba9d458f434dc38e663dc0f08e96121e | Hash listed as a BabyLockerKZ ransomware sample. |
| SHA256 | 2eddfe711c32ef1668e14a10d00452c83c29e394e17c41f491550a1583c1bcac | Hash listed for the Checker tool. |
| SHA256 | 33a8024395c56fab4564b9baef1645e505e00b0b36bff6fad3aedb666022599a | Hash listed as a BabyLockerKZ ransomware sample. |
| SHA256 | 364f1b7466d8e4c9f55294ecf1f874c763bcf980c59b0250c613ac366def6aca | Hash listed as a BabyLockerKZ ransomware sample. |
| SHA256 | 48046fb0e566f5a2d184f84b76d6cadc458762556daed0ae4a3a1200afbefb54 | Hash listed as a BabyLockerKZ ransomware sample. |
| SHA256 | 5d5d639fdfbf632bb7d9f1bb28731217d09d36078ab5e594baf2a5a41267a5d2 | Hash listed as a BabyLockerKZ ransomware sample. |
| SHA256 | 63eb3d2886d9cb880c9b0d54b94f3e149b3b5b6215a33a0ef63588a09dcd4499 | Hash listed as a BabyLockerKZ ransomware sample. |
| SHA256 | 6ae3a58a78be9c606009c657de4e390538b21ad951e62b6f4d31138e1a75732c | Hash listed for the Checker tool. |
| SHA256 | 759b96f44806578cc0836a3a2bf11c8bc553effac72f8d28b94aec78b66be906 | Hash listed as a BabyLockerKZ ransomware sample. |
| SHA256 | 8bc455e5de35290f8a94376357947bd72aaf6f4d452c25a8ef444e037ef76b9f | Hash listed for the PTH tool. |
| SHA256 | 8edbb1944d94ff91ee917c31590b6d1d5690a52fc153e44355ee9749aa0f4625 | Hash listed as a BabyLockerKZ ransomware sample. |
| SHA256 | 9f066975f1e02b29c7c635280f405c59704ce4f4e06b04e9ac8a7eac22acd3c7 | Hash listed for the PTH tool. |
| SHA256 | b8c994e3ed7dcc9080916119ddc315533c129479f508676d7544b82b2e24745f | Hash listed as a BabyLockerKZ ransomware sample. |
| SHA256 | c0c726a23111c220d022fcd01a85f9788249e42baece03f83b6059170453b801 | Hash listed as a BabyLockerKZ ransomware sample. |
| SHA256 | d00f7cf6af68ba832b9d364f28411346cfe66fd3b1f5bcac318766add29ff7f0 | Hash listed for the Checker tool. |
| SHA256 | dc4840a0992b218cbedd5a7ac5c711cb98f1f9e78a8ffdea37c694061dfd34c6 | Hash listed as a BabyLockerKZ ransomware sample. |
MITRE ATT&CK
T1003 · OS Credential DumpingMimikatz and the MIMIK wrapper retrieve credentials from memory and the SAM database.T1003.001 · LSASS MemoryThe article's example commands invoke sekurlsa::logonPasswords to retrieve logon credentials from memory.T1003.002 · Security Account ManagerThe article's example commands invoke lsadump::sam to retrieve SAM data.T1021.001 · Remote Desktop ProtocolChecker supports lateral movement using Remote Desktop Protocol.T1021.002 · SMB/Windows Admin SharesChecker supports lateral movement using SMB and PSEXEC.T1021.003 · Distributed Component Object ModelChecker and Invoke-TheHash scripts support remote WMI execution.T1547.001 · Registry Run Keys / Startup FolderBabyLockerKZ uses a Windows Run registry key for autorun.T1550.002 · Pass the HashThe PTH project and embedded Invoke-TheHash scripts use NTLM hashes for pass-the-hash authentication over SMB and WMI.T1560 · Archive Collected DataBabyLockerKZ encrypts files on victim systems.T1562.001 · Disable or Modify ToolsHRSword is identified as a tool used to disable antivirus and EDR software.T1567.002 · Exfiltration to Cloud StorageThe MIMIK wrapper can automatically upload stolen credentials to an attacker-controlled server.
People
Malware
BabyLockerKZThis threat actor was observed distributing a MedusaLocker ransomware variant known as “BabyLockerKZ.” This variant is compiled with a PDB path containing the word “paid_memes” which is also present in other toolsMedusaLockerThreat actor believed to be spreading new MedusaLocker variant since 2022MimikatzMimikatz: A tool to dump Windows user credentials from memory.
Vendors
Products
Adaptive Security ApplianceCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Advanced Port Scannerc:/users/<user>/appdata/local/temp/advanced port scanner 2/advanced_port_scanner.exeCisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network. Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Network/Cloud AnalyticsCisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.ClamAVClamAV detections are also available for this threat:Meraki MXCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.rcloneMIMIK (D:\Projects\paid_memes\mimik\Release\stub_mimik.pdb) is a wrapper around Mimikatz and rclone that can be used to steal credentials and automatically upload them to an attacker-controlled server. The followingSnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. SIDs for this threat: Snort3 Rules: 1:300998:1:0 Snort2 Rules: 1:63928:1:0,SoftPerfect Network ScannerNetscan.exe: SoftPerfect Network Scanner: A tool similar to Advanced Port Scanner.Threat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.UmbrellaUmbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.
Tools
Checkertools that have the PDB path with the string “paid_memes,” and the use of a lateral movement tool named “checker” — used in the attack led us to take a deeper look to try to understand more about this threat actor. HRSwordc:\users\<user>\music\hrsword\hrsword install.batInvoke-TheHashc:/users/<user>/music/checker/invoke-thehash.ps1MIMIKMIMIK toolPCHunter64PCHunter64.exe: A tool similar to processhacker.ProcesshackerProcesshacker.exe: Process Monitoring and administration software. Allows a TA to enumerate and control processes running on the infected endpoint.PsExecprocess by automating the interaction between popular attack tools (e.g., Mimikatz, Invoke-the-hash, PSEXEC, RDP) and by adding convenient functionality and interfaces. One of these tools, called “Checker” used inPTHPTH projectRCloneMIMIK (D:\Projects\paid_memes\mimik\Release\stub_mimik.pdb) is a wrapper around Mimikatz and rclone that can be used to steal credentials and automatically upload them to an attacker-controlled server. The followingRemote Desktop PlusRemote Desktop Plus
Countries
Argentinaalmost doubled, and the group shifted its focus toward Latin American countries such as Brazil, Mexico, Argentina and Colombia, as shown in the chart below. The attacks kept a steady volume of around 200 unique IPsBrazilvolume per month almost doubled, and the group shifted its focus toward Latin American countries such as Brazil, Mexico, Argentina and Colombia, as shown in the chart below. The attacks kept a steady volume of aroundColombiaand the group shifted its focus toward Latin American countries such as Brazil, Mexico, Argentina and Colombia, as shown in the chart below. The attacks kept a steady volume of around 200 unique IPs compromised perFrancesince at least October 2022. At that time, the targets were mostly located in European countries such as France, Germany, Spain or Italy. During the second quarter of 2023, the attack volume per month almost doubled,Germanyleast October 2022. At that time, the targets were mostly located in European countries such as France, Germany, Spain or Italy. During the second quarter of 2023, the attack volume per month almost doubled, and theItalyAt that time, the targets were mostly located in European countries such as France, Germany, Spain or Italy. During the second quarter of 2023, the attack volume per month almost doubled, and the group shifted itsMexicoper month almost doubled, and the group shifted its focus toward Latin American countries such as Brazil, Mexico, Argentina and Colombia, as shown in the chart below. The attacks kept a steady volume of around 200Spain2022. At that time, the targets were mostly located in European countries such as France, Germany, Spain or Italy. During the second quarter of 2023, the attack volume per month almost doubled, and the group