Darktrace Details ShadowSyndicate’s RansomHub Attacks on Customers
Summary
Darktrace identified four RansomHub incidents attributed to ShadowSyndicate across customer networks, involving reconnaissance, data exfiltration, lateral movement and, in three cases, encryption.
Key points
- Darktrace reported four incidents affecting customers in education, manufacturing and social services during September and October 2024.
- Observed activity included internal scanning over TCP ports 22, 445 and 3389, followed by connections associated with Splashtop and outbound SSH.
- In multiple cases, attackers exfiltrated gigabytes of data over SSH to infrastructure associated with ShadowSyndicate; other transfers used MEGA or SSL connections.
- Lateral movement included use of a new administrative credential and suspicious executable and batch-file writes over SMB.
- Three investigated cases involved file encryption and ransom notes threatening to leak stolen data.
- The attacks succeeded where Darktrace Autonomous Response was not enabled; its Cyber AI Analyst helped identify affected devices and support remediation.
Article Details
- Attack Vectors
- Internal network scanning and enumeration using connection attempts over TCP ports 22, 445, and 3389.
- Outbound SSH data exfiltration to external endpoints, including transfers using WinSCP.
- Data exfiltration to MEGA via HTTP using the rclone user agent; another observed transfer used SSL over port 443.
- Lateral movement involving a new administrative credential and suspicious executable writes to internal devices over SMB.
- Suspicious batch scripts were written over SMB, including Defeat-Defender2.bat, Share.bat, and def.bat.
- RansomHub encrypted files and used ransom notes threatening to leak stolen confidential data.
- Defensive Notes
- Darktrace recommended manual response actions to contain the compromise and prevent further malicious activity; it stated that Autonomous Response could have applied these actions automatically if enabled.
- Darktrace's Cyber AI Analyst helped identify affected devices and support remediation; Managed Threat Detection raised alerts about active ransomware incidents.
- Monitor unusual internal connections, outbound SSH transfers, SMB file writes, new administrative credentials, suspicious batch scripts, and file-extension changes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | ams-rb9a-ss[.]ams[.]efscloud[.]net | Listed as a data exfiltration endpoint. |
| HOSTNAME | w[.]api[.]mega[.]co[.]nz | Listed as a MEGA endpoint used for data exfiltration. |
| IPV4 | 103[.]253[.]40[.]87 | Listed as a C2 endpoint. |
| IPV4 | 104[.]226[.]39[.]18 | Listed as a C2 endpoint. |
| IPV4 | 108[.]181[.]182[.]143 | Listed as a data exfiltration endpoint. |
| IPV4 | 185[.]206[.]24[.]31 | Listed as a MEGA endpoint used for data exfiltration. |
| IPV4 | 185[.]65[.]212[.]164 | Listed as a data exfiltration endpoint. |
| IPV4 | 31[.]216[.]148[.]33 | Listed as a MEGA endpoint used for data exfiltration. |
| IPV4 | 46[.]161[.]27[.]151 | CISA identified this IP as malicious and associated it with ShadowSyndicate C2; Darktrace observed SSH data exfiltration to it. |
| IPV4 | 66[.]203[.]125[.]21 | Listed as a MEGA endpoint used for data exfiltration. |
| IPV4 | 83[.]97[.]73[.]198 | Listed as a data exfiltration endpoint. |
| IPV4 | 89[.]44[.]168[.]207 | Listed as a MEGA endpoint used for data exfiltration. |
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesSuspicious executables and batch scripts were written to internal devices over SMB.T1021.004 · SSHThe article reports outbound SSH data transfers to external endpoints.T1046 · Network Service DiscoveryAffected devices attempted connections to internal devices over TCP ports 22, 445, and 3389, consistent with network service scanning.T1486 · Data Encrypted for ImpactRansomHub encrypted files and appended a six-character alphanumeric extension.T1567.002 · Exfiltration to Cloud StorageData was transferred to MEGA cloud storage via HTTP using the rclone user agent.
People
Threat Actors
Infra StormThe article identifies Infra Storm as another name for ShadowSyndicate.RansomHubRansomware-as-a-Service operator whose ransomware ShadowSyndicate was observed using in attacks.ShadowSyndicateReportedly active since July 2022 and linked to multiple ransomware programs; Darktrace observed the group using RansomHub in attacks during September and October 2024.
Malware
IcedIDsuch as Quantum, Nokoyawa, and ALPHV. This threat actor employs tools like Cobalt Strike, Sliver, IcedID, and Matanbuchus malware in its attacks. ShadowSyndicate utilizes the same SSH fingerprintMatanbuchusQuantum, Nokoyawa, and ALPHV. This threat actor employs tools like Cobalt Strike, Sliver, IcedID, and Matanbuchus malware in its attacks. ShadowSyndicate utilizes the same SSH fingerprintRansomHubWhat is RansomHub?
Vendors
Products
MEGAthreat actors were also observed transferring data to the cloud storage and file transfer service, MEGA, via HTTP connections using the ‘rclone’ user agent – a command-line program used to manage files on cloudMicrosoft Defender Antimalware Platformthat threat actors were trying to evade network defenses and detection by antivirus software like Microsoft Defender.Splashtopmost of the RansomHub cases investigated by Darktrace, unusual connections to endpoints associated with Splashtop, a remote desktop access software, were observed briefly before outbound SSH connections were identified.
Tools
Cobalt Strikeof ransomware programs, such as Quantum, Nokoyawa, and ALPHV. This threat actor employs tools like Cobalt Strike, Sliver, IcedID, and Matanbuchus malware in its attacks. ShadowSyndicate utilizes the same SSHRClonetransferring data to the cloud storage and file transfer service, MEGA, via HTTP connections using the ‘rclone’ user agent – a command-line program used to manage files on cloud storage. In another case, dataSliverprograms, such as Quantum, Nokoyawa, and ALPHV. This threat actor employs tools like Cobalt Strike, Sliver, IcedID, and Matanbuchus malware in its attacks. ShadowSyndicate utilizes the same SSH fingerprintWinSCPthis, Darktrace detected outbound SSH connections to the external IP address 46.161.27[.]151 using WinSCP, an open-source SSH client for Windows used for secure file transfer. The Cybersecurity and
Industries
Educationrevealed four separate incidents impacting Darktrace customers across various sectors, including education, manufacturing, and social services. In the investigated cases, multiple stages of the kill chain wereManufacturingfour separate incidents impacting Darktrace customers across various sectors, including education, manufacturing, and social services. In the investigated cases, multiple stages of the kill chain were observed,social servicesimpacting Darktrace customers across various sectors, including education, manufacturing, and social services. In the investigated cases, multiple stages of the kill chain were observed, starting with initial