Huntress Analyzes New Obscura Ransomware Variant
Summary
Huntress analyzed a previously unseen ransomware variant found across a victim organization’s hosts. Its investigation details deployment through a domain controller’s NETLOGON share, security-process termination, recovery deletion, and file encryption; initial access
Key points
- Huntress analysts encountered Obscura on August 29, 2025, across multiple hosts at a victim organization. Limited Huntress agent coverage hindered response and left the initial access vector unknown.
- The executable was placed in the domain controller’s NETLOGON share, whose contents replicate across domain controllers, and scheduled tasks ran it on multiple hosts.
- A separate scheduled task enabled Remote Desktop Protocol access through the Windows firewall.
- The ransomware requires administrative privileges, attempts to delete Volume Shadow Copies, and terminates processes associated with security, backup, database, and monitoring software.
- Obscura uses X25519 to derive an encryption key and XChaCha20 to encrypt files, appending a footer containing a public key and nonce.
- The binary contains domain-role messages suggesting propagation, but Huntress found no lateral movement functionality beyond local encryption.
- Huntress recommends monitoring domain controllers for new or modified files, including Group Policy Objects, and watching for suspicious access on servers and workstations.
Article Details
- Attack Vectors
- The initial access vector was not determined; limited Huntress agent deployment reduced visibility.
- The ransomware executable was placed in the domain controller's NETLOGON share, where it was automatically replicated to other domain controllers.
- A scheduled task named SystemUpdate was created on multiple hosts, including the domain controller, to execute the ransomware from the NETLOGON share.
- A separate scheduled task on a user's machine ran a command to enable Remote Desktop access through the Windows firewall.
- Defensive Notes
- Monitor domain controllers for new files and changes to existing files, including Group Policy Objects.
- Monitor domain controllers, servers, and workstations for unusual or suspicious access.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | c00a2d757349bfff4d7e0665446101d2ab46a1734308cb3704f93d20dc7aac23 | SHA-256 hash identified in the article as belonging to the Obscura ransomware executable. |
MITRE ATT&CK
T1053.005 · Scheduled TaskObscura was launched through scheduled tasks named SystemUpdate on multiple hosts and iJHcEkAG on a user's machine.T1059.003 · Windows Command ShellScheduled tasks ran cmd.exe commands to enable Remote Desktop through the Windows firewall and to delete volume shadow copies with vssadmin.T1486 · Data Encrypted for ImpactObscura encrypted files using XChaCha20 and appended a footer containing a public key and nonce.T1490 · Inhibit System RecoveryObscura ran vssadmin delete shadows /all /quiet to delete volume shadow copies and inhibit recovery.T1562.001 · Disable or Modify ToolsObscura attempted to terminate security and backup-related processes from a hardcoded target list before encryption.