Huntress Details How Ransomware Operators Deploy Their Payloads
Summary
Huntress analysts describe ransomware deployment methods observed in incidents, including manual launches, remote network shares, PsExec-based tools, and Active Directory servers, and explain how monitoring can help detect activity.
Key points
- Huntress says ransomware executables generally encrypt files and leave ransom notes; threat actors typically handle access, file copying, and deployment.
- On-host deployments may involve actors accessing endpoints over RDP, copying an executable, and launching it manually.
- Observed Akira and Crux deployments included commands to disable recovery options.
- SafePay and some Akira affiliates were observed launching ransomware across network shares using UNC paths.
- In one incident, a custom tool renamed GoGo.exe pushed a PLAY ransomware executable to other endpoints and spawned PsExec64.exe processes.
- Ransomware has also been placed on a domain controller’s NETLOGON share and launched on endpoints through Scheduled Tasks.
- Huntress recommends maintaining an asset inventory, reducing the attack surface, and deploying monitoring and detection capabilities such as EDR and SIEM.
Article Details
- Attack Vectors
- Threat actors access endpoints, usually via RDP, then copy and manually launch ransomware using Command Prompt or PowerShell.
- Ransomware is copied to a nexus endpoint and launched against remotely accessible shares via UNC paths.
- PSExec and variants can copy and launch ransomware on remote systems; one incident used custom ps_bulk.exe, renamed GoGo.exe, to distribute PLAY ransomware.
- Ransomware may be placed in a domain controller's NETLOGON share and launched on endpoints through Scheduled Tasks.
- An Akira affiliate attempted deployment using compromised credentials for MSP remote monitoring and management instances.
- Defensive Notes
- Maintain an accurate inventory of physical and virtual endpoints and applications.
- Reduce the attack surface by reviewing what must be publicly accessible, applying protections, and removing unnecessary public access.
- Deploy monitoring and detection capabilities such as EDR and SIEM across the environment.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThreat actors usually access endpoints via Remote Desktop Protocol (RDP) before copying and launching ransomware.T1021.002 · SMB/Windows Admin SharesSafePay and Akira were observed being deployed to remotely accessible shares via UNC paths.T1041 · Exfiltration Over C2 ChannelThe article describes attackers exfiltrating data before deploying SafePay ransomware.T1053.005 · Scheduled TaskObscura was reportedly launched on individual endpoints from a domain controller's NETLOGON share through Scheduled Tasks.T1059.001 · PowerShellAkira ransomware was manually launched via PowerShell; a child process also used PowerShell to remove shadow copies.T1059.003 · Windows Command ShellRansomware was manually launched via Command Prompt, and a Crux child process ran bcdedit commands through Cmd.exe.T1105 · Ingress Tool TransferActors copy ransomware executables from their access point to endpoints, including remote systems.T1489 · Service StopThe Akira deployment command removed Windows shadow copies, disabling a recovery option.T1490 · Inhibit System RecoveryThe Crux deployment command disabled recovery and set boot status policy to ignore failures using bcdedit.T1569.002 · Service ExecutionA custom tool renamed GoGo.exe spawned PsExec64.exe processes to push and launch PLAY ransomware on other endpoints.
People
Malware
AkiraAlso, we want to make clear that variants that follow the “ransomware-as-a-service” (RaaS) model, such as Akira, are deployed by different affiliates, and as such, different affiliate actors may use similar or vastlyCephalusSOC analysts have observed across a number of ransomware families, including ReadText34, INC, Crux, Cephalus, and Akira. In these incidents, the threat actor accesses each endpoint, usually via the Remote DesktopCruxHuntress SOC analysts have observed across a number of ransomware families, including ReadText34, INC, Crux, Cephalus, and Akira. In these incidents, the threat actor accesses each endpoint, usually via the RemoteINC ransomwareHuntress SOC analysts have observed across a number of ransomware families, including ReadText34, INC, Crux, Cephalus, and Akira. In these incidents, the threat actor accesses each endpoint, usually via theObscuraHuntress recently published a blog post describing how the Obscura ransomware was placed on a domain controller, in the NETLOGON share, and launched on individual endpoints through the use of Scheduled Tasks.Playan incident where the threat actor used a custom tool named ps_bulk.exe, renamed to GoGo.exe, to push a PLAY ransomware executable out to other endpoints within the network, using command lines similar to theReadText34This is something Huntress SOC analysts have observed across a number of ransomware families, including ReadText34, INC, Crux, Cephalus, and Akira. In these incidents, the threat actor accesses each endpoint, usuallySafePayAn example of ransomware that has been observed being deployed in this manner is SafePay. Prior to deploying the ransomware, a threat actor will often exfiltrate data and enumerate the network, obtaining a list of
Vendors
Products
AkiraAlso, we want to make clear that variants that follow the “ransomware-as-a-service” (RaaS) model, such as Akira, are deployed by different affiliates, and as such, different affiliate actors may use similar or vastlyCephalusSOC analysts have observed across a number of ransomware families, including ReadText34, INC, Crux, Cephalus, and Akira. In these incidents, the threat actor accesses each endpoint, usually via the Remote DesktopCruxHuntress SOC analysts have observed across a number of ransomware families, including ReadText34, INC, Crux, Cephalus, and Akira. In these incidents, the threat actor accesses each endpoint, usually via the RemoteEDRNext, businesses should fully deploy monitoring and detection capabilities, such as EDR and SIEM. Not doing so means that a threat actor can gain access to an unmanaged endpoint, perform all of their preparatoryINCHuntress SOC analysts have observed across a number of ransomware families, including ReadText34, INC, Crux, Cephalus, and Akira. In these incidents, the threat actor accesses each endpoint, usually via theMicrosoft WindowsHuntress analysts have observed the ransomware being launched from various folders, including C:\Windows and C:\Temp, and with various file names. However, commonalities across the incidents include the factObscuraHuntress recently published a blog post describing how the Obscura ransomware was placed on a domain controller, in the NETLOGON share, and launched on individual endpoints through the use of Scheduled Tasks.PLAYan incident where the threat actor used a custom tool named ps_bulk.exe, renamed to GoGo.exe, to push a PLAY ransomware executable out to other endpoints within the network, using command lines similar to theReadText34This is something Huntress SOC analysts have observed across a number of ransomware families, including ReadText34, INC, Crux, Cephalus, and Akira. In these incidents, the threat actor accesses each endpoint, usuallyRemote Desktop Protocol (RDP)that state: “the ransomware uses stolen credentials to access systems via the Remote Desktop Protocol (RDP)...” However, this simply isn’t the case at all.SafePayAn example of ransomware that has been observed being deployed in this manner is SafePay. Prior to deploying the ransomware, a threat actor will often exfiltrate data and enumerate the network, obtaining a list ofSIEMNext, businesses should fully deploy monitoring and detection capabilities, such as EDR and SIEM. Not doing so means that a threat actor can gain access to an unmanaged endpoint, perform all of their preparatory
Tools
GoGo.exeUse of PSExec/GoGo.exeps_bulk.exeHuntress analysts recently observed an incident where the threat actor used a custom tool named ps_bulk.exe, renamed to GoGo.exe, to push a PLAY ransomware executable out to other endpoints within the network, usingPsExecUse of PSExec/GoGo.exePsExec64.exeWhen launched, the command line would spawn multiple PsExec64.exe processes; Figure 2 illustrates the GoGo.exe process tree.