New Yashma Ransomware Campaign Targets Victims in Multiple Countries
Summary
Cisco Talos analyzed a Yashma ransomware campaign active since at least June 2023. The customized variant downloads ransom notes from GitHub, mimics WannaCry, persists through a startup-folder URL file, and wipes original files after encryption.
Key points
- Talos says the campaign began around June 4, 2023, and targets English-speaking countries, Bulgaria, China, and Vietnam.
- The actor used a customized Yashma variant, a .NET executable based on Chaos ransomware V5.
- An embedded batch file downloads ransom-note text from an actor-controlled GitHub repository instead of storing the text in the binary.
- The ransom notes and desktop wallpaper mimic WannaCry; notes demand Bitcoin and threaten to double the price after three days.
- The variant maintains persistence through the Windows Run registry key and a startup-folder .url file pointing to an executable in AppData.
- After encrypting files, the ransomware overwrites the originals with a single character and deletes them, hindering recovery and forensic analysis.
- Talos published Snort rule identifiers and a ClamAV detection for the threat.
Article Details
- Attack Vectors
- A customized Yashma ransomware variant encrypts victim files and uses an embedded batch file to download its ransom note from an actor-controlled GitHub repository.
- The ransomware establishes persistence through the Run registry key and a .url bookmark file in the startup folder pointing to the dropped executable.
- Defensive Notes
- Cisco recommends Secure Endpoint, Secure Web Appliance, Secure Email, Secure Firewall, Secure Malware Analytics, Umbrella, and Cisco Duo protections.
- Snort rules for this threat are listed as SIDs 62131–62143 and 300633–300638; ClamAV detection is Win.Ransomware.Hydracrypt-9878672-0.
- Cisco Secure Endpoint users can use Orbital Advanced Search with threat-specific OSqueries to check endpoints.
MITRE ATT&CK
T1105 · Ingress Tool TransferAn embedded batch file downloads the ransom note from the actor-controlled GitHub repository.T1485 · Data DestructionAfter encryption, the ransomware overwrites the original file contents with a single character and deletes the file, hindering recovery.T1486 · Data Encrypted for ImpactThe Yashma variant encrypts files on victim machines.T1547.001 · Registry Run Keys / Startup FolderThe variant establishes persistence through the Run registry key and a .url file in the startup folder.
Malware
Chaos ransomware V5on June 4, 2023. Yashma is a 32-bit executable written in .Net and a rebranded version of Chaos ransomware V5, which appeared in May 2022. In this variant, most of Yashma’s features remained unchanged and haveWannaCryThis ongoing attack uses a variant of the Yashma ransomware likely to target multiple geographic areas by mimicking WannaCry characteristics.YashmaNew threat actor targets Bulgaria, China, Vietnam and other countries with customized Yashma ransomware
Vendors
Products
Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.ClamAVClamAV detections are available for this threat:GitHubembedding the ransom note strings in the binary, they download the ransom note from the actor-controlled GitHub repository by executing an embedded batch file.Microsoft Windowsransomware established persistence on the victim machine in the Run registry key and by dropping a Windows shortcut file pointing to the ransomware executable path in the startup folder. The variant we observedSecure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat are 62131 - 62143 and 300633 - 300638.UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.
Countries
BulgariaNew threat actor targets Bulgaria, China, Vietnam and other countries with customized Yashma ransomwareChinaNew threat actor targets Bulgaria, China, Vietnam and other countries with customized Yashma ransomwareVietnamNew threat actor targets Bulgaria, China, Vietnam and other countries with customized Yashma ransomware