Tortilla Campaign Exploits Exchange Servers to Deploy Babuk Ransomware
Summary
Cisco Talos details Tortilla’s campaign exploiting ProxyShell vulnerabilities in Microsoft Exchange to deploy Babuk, disable backups, delete shadow copies and encrypt files. The chain uses PowerShell, staged loaders and pastebin[.]pl.
Key points
- Talos observed the campaign targeting vulnerable Exchange servers, likely exploiting ProxyShell and using a China Chopper web shell for initial access.
- A modified EfsPotato downloader runs obfuscated PowerShell, bypasses AMSI and downloads additional modules from fbi[.]fund or xxxs[.]info.
- The staged loader retrieves an unpacker from pastebin[.]pl, decrypts the Babuk payload in memory and injects it into a process such as AddInProcess32.exe.
- Babuk terminates backup-related services, deletes Volume Shadow Copies and encrypts files with the .babyk extension; the actor demands $10,000 in Monero.
- The campaign predominantly affected users in the U.S., with smaller numbers in several other countries. Talos assessed Tortilla as a relatively new actor operating since July 2021.
- Talos recommends patching externally facing servers, maintaining sound backups and monitoring for service termination, high disk I/O and shadow-copy deletion.
Article Details
- Attack Vectors
- The campaign likely gained initial access by exploiting ProxyShell vulnerabilities in Microsoft Exchange Server; Talos assessed this with moderate confidence.
- Downloaders used a modified EfsPotato exploit targeting ProxyShell and PetitPotam vulnerabilities, followed by obfuscated PowerShell commands to retrieve and run additional modules.
- The campaign used China Chopper web shells on observed infected systems; Talos believed the web shell ran the initial download command.
- The malware downloaded an intermediate unpacker from pastebin.pl, decrypted the Babuk payload in memory, and injected it into a newly created process.
- Babuk disabled backup-related services, deleted volume shadow copies with vssadmin, and encrypted files on the victim server and mounted drives.
- Defensive Notes
- Apply the latest available security patches to externally facing servers, applications, and important internal assets.
- Enable behavioral protection on endpoints and servers and monitor for abrupt service termination, unusually high drive I/O, shadow-copy deletion, and system configuration changes.
- Maintain sound backups, central logging, and XDR coverage for important organizational resources.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | fbi[.]fund | Actor-controlled domain used to host and distribute campaign modules. |
| DOMAIN | xxxs[.]info | Actor-controlled domain used to host campaign modules before the actor switched to fbi[.]fund. |
mitnickd@ctemplar[.]com | Ransomware contact email disclosed to victims for payment-related instructions. | |
zar8b@tuta[.]io | Ransomware contact email disclosed to victims for payment-related instructions. | |
| IPV4 | 168[.]119[.]93[.]163 | Listed by the article as an IOC; its specific role is not described. |
| IPV4 | 185[.]219[.]52[.]229 | Actor-controlled download server hosting malicious campaign modules. |
| IPV4 | 54[.]221[.]65[.]242 | Listed by the article as an IOC; its specific role is not described. |
| SHA256 | 07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235 | Hash of a sample from a previous campaign. |
| SHA256 | 08d799cc27063bc7969ae935ca171b518d0b41b1feaa9775bae06bd319291b41 | Hash of a Stage 2 Swrort variant containing the ransomware payload. |
| SHA256 | 0994c1fc7f66f88eead2091f31a2137f69d08c3cf9ee0f4a15a842f54253c9d9 | Hash of a Stage 2 Swrort variant containing the ransomware payload. |
| SHA256 | 1d28c4c85e241efbbe326051999b9a8e1d8eeb9a3322da5cb9a93c31c65bbb49 | Hash of a Stage 2 Swrort variant containing the ransomware payload. |
| SHA256 | 47033d071e1c79cc03f8b4081f5f6d470d45e32a90b06ee96bfe6c3df2f47d40 | Hash of a Stage 1 DLL downloader. |
| SHA256 | 4fa565cc2ebfe97b996786facdb454e4328a28792e27e80e8b46fe24b44781af | Hash of a leaked Babuk builder. |
| SHA256 | 56b7e6dd46e38a30ead82790947a425661ad893f54060381c9b76616c27d3b9f | Hash of a Stage 1 DLL downloader. |
| SHA256 | 5f35dbf807c844c790b9cffc9f83eca05d32f58b737ba638c9567b8d22119f96 | Hash of a Stage 2 Swrort variant containing the ransomware payload. |
| SHA256 | 752d66990097c8be7760d8d6011b1e91daa1d5518951d86f9fdf3d126d54872a | Hash of the modified EfsPotato downloader variant. |
| SHA256 | 949c262359f87c8a0e8747f28a89cf3d519b35fbc5a8be81b2cd9e6adc830370 | Hash of a PowerCat netcat-clone sample associated with the actor. |
| SHA256 | b3b66f7e70f1e1b1494677d0ed79fcc7d4901ffae53d89fd023c8b789bb0fe62 | Hash of a related sample described as a reverse shell connecting to the actor-controlled server. |
| SHA256 | bd26b65807026a70909d38c48f2a9e0f8730b1126e80ef078e29e10379722b49 | Hash of a Babuk ransomware payload. |
| URL | hxxp[:]//185[.]219[.]52[.]229:8080/vefEPjwOdNF9qNw[.]hta | Listed as a campaign IOC on the actor-controlled server. |
| URL | hxxp[:]//185[.]219[.]52[.]229/tortilla[.]exe | Malicious payload download URL on the actor-controlled server. |
| URL | hxxp[:]//185[.]219[.]52[.]229/tortillas/tore[.]exe | Malicious module download URL on the actor-controlled server. |
| URL | hxxp[:]//185[.]219[.]52[.]229/tortillas/tortilla[.]exe | Payload download URL on the actor-controlled server. |
| URL | hxxp[:]//fbi[.]fund/dark[.]exe | Malicious loader download URL on actor-controlled infrastructure. |
| URL | hxxp[:]//fbi[.]fund/tortillas/tore[.]exe | Malicious module download URL on actor-controlled infrastructure. |
| URL | hxxp[:]//fbi[.]fund/tortillas/tortilla[.]exe | Payload download URL on actor-controlled infrastructure. |
| URL | hxxp[:]//xxxs[.]info/kaido[.]exe | Malicious executable URL from a related campaign on an actor-controlled domain. |
| URL | hxxps[:]//pastebin[.]pl/view/raw/a57be2ca | Specific URL used to retrieve the campaign's intermediate unpacking module. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaign uses obfuscated PowerShell and encrypted, packed payload stages that are decrypted in memory.T1055 · Process InjectionThe unpacker injects the decrypted Babuk payload into a newly created process such as AddInProcess32.exe.T1059 · Command and Scripting InterpreterThe downloader invokes an obfuscated PowerShell command through the command shell.T1105 · Ingress Tool TransferThe downloader retrieves loader and unpacker modules from actor infrastructure and pastebin.pl.T1490 · Inhibit System RecoveryBabuk deletes volume shadow copies with vssadmin to prevent recovery of encrypted files.T1518 · Software DiscoveryThe intermediate unpacker enumerates services to check for sandbox and virtual-machine environments.T1553.005 · Mark-of-the-Web BypassThe unpacker deletes the loader's zone identifier alternate data stream to hide that it was downloaded from the internet.T1562.001 · Disable or Modify ToolsThe downloader disables Windows Defender real-time monitoring, script scanning, and behavior monitoring.
CVE
People
Threat Actors
Malware
AgentTeslaAlthough legitimate, we have observed several previous malicious campaigns, including variants of AgentTesla and Formbook hosting their additional content on the site. Access to the site from a company's networkBabukMicrosoft Exchange vulnerabilities exploited once again for ransomware, this time with BabukChina ChopperWe assess with moderate confidence that the initial infection vector is exploitation of ProxyShell vulnerabilities in Microsoft Exchange Server through the deployment of China Chopper web shell.FormBooklegitimate, we have observed several previous malicious campaigns, including variants of AgentTesla and Formbook hosting their additional content on the site. Access to the site from a company's network may indicate aPowercatTortilla has been experimenting with other payloads, such as the PowerShell-based netcat clone Powercat, which is known to provide attackers with unauthorized access to Windows machines.
Vendors
CiscoCisco Talos recently discovered a malicious campaign deploying variants of the Babuk ransomware predominantly affecting users in the U.S. with smaller number of infections in U.K., Germany, Ukraine, Finland, Brazil,MicrosoftMicrosoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk
Products
Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such asThreat Defense Virtual,Adaptive Security Appliance andMeraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (formerly Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Microsoft Exchange ServerWe assess with moderate confidence that the initial infection vector is exploitation of ProxyShell vulnerabilities in Microsoft Exchange Server through the deployment of China Chopper web shell.UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.Veeamon the victim's server and attempts to disable a number of processes related to backup products, such as Veeam backup service. It also deletes volume shadow service (VSS) snapshots from the server using vssadminWindows DefenderThe actor executes an AMSI bypass and disables the Windows Defender real-time monitoring, script scanning and behavior monitoring by executing the commandlet Set-MpPreference.
Tools
certutil.exeThe PowerShell command invokes a web request and downloads the payload loader module using certutil.exe from a URL hosted on the domains fbi[.]fund and xxxs[.]info, or the IP address 185[.]219[.]52[.]229.ClamAVThe following ClamAV signatures have been released to detect this threat:ConfuserExsystem (SMS) application not to be confused with the SMS messaging protocol. The module is packed with ConfuserEx, a free, open-source protector for .NET applications. This stage is downloaded by a process launched byEfsPotatoThe initial downloader is a modified EfsPotato exploit to target proxyshell and PetitPotam vulnerabilities. The downloader runs an embedded obfuscated PowerShell command to connect and download a packed downloaderOrbital Advanced SearchCisco Secure Endpoint users can use Orbital Advanced Search to run complex OSqueries to see if their endpoints are infected with this specific threat. For specific OSqueries on this threat, click filepath and mutex.PowerCatTortilla has been experimenting with other payloads, such as the PowerShell-based netcat clone Powercat, which is known to provide attackers with unauthorized access to Windows machines.SnortOur telemetry also indicates that the actor's infrastructure was active in attempting to exploit a number of vulnerabilities in other products most commonly triggering the following Snort rules:vssadminas Veeam backup service. It also deletes volume shadow service (VSS) snapshots from the server using vssadmin utility to make sure the encrypted files cannot be restored from their VSS copies. The ransomware module
Countries
Brazilaffecting users in the U.S. with smaller number of infections in U.K., Germany, Ukraine, Finland, Brazil, Honduras and Thailand.Finlandpredominantly affecting users in the U.S. with smaller number of infections in U.K., Germany, Ukraine, Finland, Brazil, Honduras and Thailand.GermanyBabuk ransomware predominantly affecting users in the U.S. with smaller number of infections in U.K., Germany, Ukraine, Finland, Brazil, Honduras and Thailand.Hondurasusers in the U.S. with smaller number of infections in U.K., Germany, Ukraine, Finland, Brazil, Honduras and Thailand.RussiaAccording to Shodan, the download server at the IP address 185[.]219[.]52[.]229 is located in Moscow, Russia and runs OpenSSH and Python version 3.9.7. There are two actor-controlled domains: fbi[.]fund and xxxs[.]info.Thailandin the U.S. with smaller number of infections in U.K., Germany, Ukraine, Finland, Brazil, Honduras and Thailand.Ukraineransomware predominantly affecting users in the U.S. with smaller number of infections in U.K., Germany, Ukraine, Finland, Brazil, Honduras and Thailand.United Kingdomof the Babuk ransomware predominantly affecting users in the U.S. with smaller number of infections in U.K., Germany, Ukraine, Finland, Brazil, Honduras and Thailand.United Statesa malicious campaign deploying variants of the Babuk ransomware predominantly affecting users in the U.S. with smaller number of infections in U.K., Germany, Ukraine, Finland, Brazil, Honduras and Thailand.