Huntress Details ReadText34 Ransomware Attack and Its Use of a Vulnerable Driver

Sep 22, 2024 · Original article ↗

Summary

Huntress investigators traced a ReadText34 ransomware attack involving Administrator access, RDP, a vulnerable driver that crashed security software, persistence attempts, recovery inhibition and file encryption. Limited endpoint coverage left possible data theft unassس

Key points

In September 2024, Huntress observed Administrator credentials used to access the C$ share, followed by RDP being enabled and a successful login from HOME-PC.
The attacker ran trend.exe, which appeared to install the vulnerable TrueSight driver; Trend Micro security products then crashed.
winppx.exe attempted to disable driver-signature checks, install a kernel driver and establish a reverse shell. Event logs indicated the driver failed to load, while the executable also created persistence.
readtext34.exe stopped processes and services, attempted to inhibit recovery, and persisted through the Administrator account's Run key.
The ransomware used Windows cipher.exe with the /w option to complicate recovery, then encrypted files; ransomware canaries triggered alerts.
The ransom note claimed confidential data had been collected, but investigators found no evidence of staging or exfiltration in the limited endpoint data available.
Huntress recommends exercising incident-response plans, maintaining an asset inventory, reducing attack surface and monitoring all endpoints.

Article Details

Attack Vectors: The threat actor used Administrator credentials to access the C$ share from an internal IP address, then enabled RDP through a remote reg.exe command and logged in from the workstation named HOME-PC.
The actor executed trend.exe, which was likely used to install the vulnerable TrueSight RogueKiller Antirootkit Driver (truesight.sys); security applications on the endpoint crashed after driver installation.
winppx.exe attempted to disable driver signature checks, install itself as a kernel-mode boot-start driver, and establish a reverse shell. The driver failed to load because its image hash was invalid.
readtext34.exe used process-termination and service-stop commands, attempted to inhibit recovery by deleting Volume Shadow Copies and system backups, and persisted through the compromised Administrator account's Run key.
The ransomware encrypted files and used cipher.exe /w commands to remove data from unallocated volume space, complicating recovery. The ransom note claimed confidential data had been collected, but investigators found no evidence of staging or exfiltration in the monitored endpoint.
Defensive Notes: Develop and regularly exercise incident response plans.
Maintain a thorough asset inventory and reduce the attack surface.
Deploy endpoint monitoring across all endpoints, including servers and workstations.

Indicators of compromise

Type	Indicator	Context
EMAIL	`ithelp15@securitymy[.]name`	Ransom-note contact address attributed to the threat actor.
EMAIL	`ithelp15@yousheltered[.]com`	Ransom-note contact address attributed to the threat actor.
IPV4	`94[.]198[.]50[.]195`	IP address supplied to winppx.exe as the reverse-shell connection target; VirusTotal references cited in the article identify it as C2 for the BianLian Go Trojan.
SHA256	`8368925651fefcd85e0e73790082b9a69237fa66225f932c2a44014cc356acdc`	SHA-256 hash of the ReadText34 ransomware executable.
SHA256	`90daac69da7201e4e081b59b61ca2a2116772318621c430f75c91a65e56ea085`	SHA-256 hash of the trend.exe installer collected from the ransomware-affected endpoint.
SHA256	`ac66828fbdf661d67562da5afb7cc8f55d9a8739ab1524e775d5dcebfc4de069`	SHA-256 hash of winppx.exe, which attempted to install a driver and launch a reverse shell.