Huntress Details Crux Ransomware Attacks, RDP Access and Recovery Disabling
Summary
Huntress details three Crux ransomware incidents, including one apparently using valid RDP credentials. The malware used svchost.exe and bcdedit.exe to disable recovery; a claimed BlackByte link remains unvalidated.
Key points
- Huntress observed Crux in three incidents; encrypted files used the .crux extension, and ransom notes followed the crux_readme_[random].txt format.
- In one incident, investigators linked initial access to valid credentials used over RDP; the access method in the first two incidents was undetermined.
- The observed process sequence ran from an unsigned ransomware executable through svchost.exe to cmd.exe and bcdedit.exe.
- The bcdedit.exe command modified boot settings to disable Windows system recovery before file encryption.
- Incident activity also included account creation, attempted lateral movement, remote Registry dumping, driver installation, and Rclone use indicating data exfiltration.
- Huntress said ransom notes claimed Crux was part of BlackByte, but it had not validated that association.
- Huntress advises securing exposed RDP and monitoring suspicious use of svchost.exe and bcdedit.exe through EDR.
Article Details
- Attack Vectors
- In one of three observed incidents, the threat actor apparently used valid credentials to access the environment via RDP; initial access was undetermined in the other two incidents.
- Ransomware execution was followed by a process chain involving svchost.exe, cmd.exe, and bcdedit.exe to disable Windows system recovery.
- In one incident, Rclone was executed to copy data to a Mega destination, indicating data exfiltration.
- Observed activity also included account creation and commands indicative of lateral movement, remote Registry dumping, and driver installation.
- Defensive Notes
- Secure exposed RDP instances.
- Monitor with EDR for suspicious behavior involving svchost.exe and bcdedit.exe.
- Monitor for unauthorized account creation, remote Registry dumping, unexpected driver installation, and Rclone use.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 667b7220f5df1b31dd2dd3d4aa1fedb4fdd2e8e5926cdacd744da7a7c6635932 | SHA-256 hash listed for a Crux ransomware executable at C:\Temp\SSW.exe. |
| SHA256 | b45e6cce412d9968e7ea67466076e7bd2d533598a9dc182699c84a0b1f72e3e4 | SHA-256 hash listed for a Crux ransomware executable at C:\Users\[redacted]\Desktop\Unrips.exe. |
| SHA256 | c96d5a279c660bfa9b70b7b2d78de951daff80fe6ad5617882587cb8e971e88b | SHA-256 hash listed for a Crux ransomware executable at C:\Windows\JZpS4GsG.exe. |
MITRE ATT&CK
T1005 · Data from Local SystemRclone copied files from the X: drive, including an Accounting directory, before transfer to a Mega destination.T1021.001 · Remote Desktop ProtocolIn one incident, the threat actor apparently accessed the endpoint using valid credentials via RDP.T1078 · Valid AccountsThe third incident involved use of valid support and administrator accounts to access the endpoint.T1135 · Network Share DiscoveryHuntress observed remote Registry dumping behavior from svchost.exe in one incident.T1136.001 · Local AccountIn the second incident, the threat actor created user accounts.T1490 · Inhibit System RecoveryThe ransomware ran bcdedit.exe to modify boot configuration and disable system recovery.T1561.002 · Disk Structure WipeCrux encrypted files, which were reported with the .crux extension.T1570 · Lateral Tool TransferThe article reports driver installation on an affected endpoint, including cfxdlfvk.sys.
Threat Actors
Malware
Products
Microsoft Defender Antimalware PlatformOn one endpoint, detection started on July 4, after Microsoft Defender flagged and blocked suspicious Registry dumping behavior (Behavior:Win32/RemoteRegDump.A) from svchost.exe.Microsoft WindowsThe ransomware executable has been seen running from different folders (e.g., temp folder, C:\Windows, etc.) and with different names on each endpoint.