GhostSec and Stormous Expand Ransomware Operations With GhostLocker 2.0
Summary
Cisco Talos details GhostSec and Stormous’s joint ransomware operations, GhostLocker 2.0’s behavior, and two tools linked to attacks on websites: a site-scanning utility and a WordPress hacking tool.
Key points
- GhostSec and Stormous jointly conducted double-extortion attacks across multiple countries and business sectors, according to group disclosures assessed by Talos.
- The groups launched the STMX_GhostLocker ransomware-as-a-service program, offering affiliates paid, free and data-publication options.
- GhostLocker 2.0 is a Golang variant that persists in the Windows Startup folder, communicates with a C2 server, and can terminate configured processes or scheduled tasks.
- In the sample analyzed, it uploaded targeted Office documents before encrypting them with the .ghost extension; it skips the C:\Windows folder.
- Talos identified a C2 server at 94[.]103[.]91[.]246 and reported that the ransomware sends infection data and files to it.
- GhostSec’s tools include a Python utility for scanning websites and GhostPresser, a shell script targeting WordPress that can bypass logins and change site settings.
Article Details
- Attack Vectors
- GhostLocker 2.0 copies itself to the Windows Startup folder for persistence, registers infections with its C2 server, uploads targeted files to the C2 server, and encrypts them.
- GhostSec and Stormous conducted joint double-extortion ransomware attacks, threatening to disclose stolen data.
- GhostSec likely used GhostPresser with cross-site scripting to compromise websites; the tool can bypass WordPress logins and modify site settings and users.
- Defensive Notes
- The article recommends Cisco Secure Endpoint, Cisco Secure Web Appliance, Cisco Secure Email, Cisco Secure Firewall, Cisco Secure Malware Analytics, Umbrella, Cisco Duo, Snort Subscriber Rule Set, and ClamAV protections.
- Snort SIDs identified for this threat are 62983-62989 and 300818-300820.
- ClamAV detection identified: Win.Ransomware.GhostSec-10020906-0.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 94[.]103[.]91[.]246 | GhostLocker 2.0 C2 server IP address identified by Talos. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelGhostLocker 2.0 uploads targeted files to its C2 server before encryption.T1486 · Data Encrypted for ImpactGhostLocker 2.0 encrypts targeted victim files and appends the .ghost extension.T1547.001 · Registry Run Keys / Startup FolderGhostLocker 2.0 copies itself to the Windows Startup folder to establish persistence.
People
Threat Actors
Malware
GhostLockerGhostSec has evolved with a new GhostLocker 2.0 ransomware, a Golang variant of the GhostLocker ransomware.GhostLocker 2.0GhostSec has evolved with a new GhostLocker 2.0 ransomware, a Golang variant of the GhostLocker ransomware.StormousXgroups operating together to conduct several double extortion attacks using the GhostLocker and StormousX ransomware programs against the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan,
Vendors
Products
Microsoft Windowsoperator had used in earlier versions to start the dropped ransomware binary from the victim’s machine Windows Startup location and the AES encryption key length of 256 bits with that of 128 bits in the earlierWordPresslibrary, a Python package used to detect the technology used by a website, such as Apache, JQuery and WordPress.
Tools
GhostPresserTalos also discovered two new tools in GhostSec arsenal, the “GhostSec Deep Scan tool” and “GhostPresser,” both likely being used in the attacks against websites.GhostSec Deep Scan toolsetthe hacking group claimed to have used in compromising legitimate websites. One of them is the “GhostSec Deep Scan toolset” to scan legitimate websites recursively, and another is a hack tool to perform cross-site
Countries
Argentinaextortion attacks using the GhostLocker and StormousX ransomware programs against the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye,Brazilagainst the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia according to our assessment of theCanadaattacks against corporate websites, including a national railway operator in Indonesia and one of Canada’s leading energy companies. They have likely leveraged their GhostPresser tool along with the cross-siteChinausing the GhostLocker and StormousX ransomware programs against the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam,Cubadouble extortion attacks using the GhostLocker and StormousX ransomware programs against the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar,EgyptPoland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia according to our assessment of the disclosure messages posted by theIndiaransomware programs against the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia according to ourIndonesiaIsrael, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia according to our assessment of the disclosure messages posted by the group in their Telegram channelsIsraeland StormousX ransomware programs against the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and IndonesiaLebanonthe GhostLocker and StormousX ransomware programs against the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand andMoroccothe victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia according to our assessment of the disclosurePolandattacks using the GhostLocker and StormousX ransomware programs against the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt,Qatarin Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia according to our assessment of the disclosure messagesSouth Africaprograms against the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia according to our assessmentThailandLebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia according to our assessment of the disclosure messages posted by the group in theirTurkiyeArgentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia according to our assessment of the disclosure messages posted byUzbekistanStormousX ransomware programs against the victims in Cuba, Argentina, Poland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia accordingVietnamPoland, China, Lebanon, Israel, Uzbekistan, India, South Africa, Brazil, Morocco, Qatar, Turkiye, Egypt, Vietnam, Thailand and Indonesia according to our assessment of the disclosure messages posted by the group in
Industries
Critical infrastructureTelegram channels highlighted the group’s continued attacks on Israel’s Industrial systems, critical infrastructure and technology companies. On Nov. 12, 2023, they claimed that the affected organizations alsoEnergycorporate websites, including a national railway operator in Indonesia and one of Canada’s leading energy companies. They have likely leveraged their GhostPresser tool along with the cross-site scripting attackindustrial systemsobservation in GhostSec’s Telegram channels highlighted the group’s continued attacks on Israel’s Industrial systems, critical infrastructure and technology companies. On Nov. 12, 2023, they claimed that the affectedRailwayattacks, GhostSec seemed to be conducting attacks against corporate websites, including a national railway operator in Indonesia and one of Canada’s leading energy companies. They have likely leveraged theirTechnologyhighlighted the group’s continued attacks on Israel’s Industrial systems, critical infrastructure and technology companies. On Nov. 12, 2023, they claimed that the affected organizations also included the Ministry of