A ransomware-as-a-service (RaaS) operation is posing as the legitimate Cicada 3301 organization and has already listed 19 victims on its extortion site. The new ransomware is employing techniques similar to BlackCat ransomware did. It uses robust encryption methods, exploits system utilities to disable security measures. The ransomware is distributed via a RaaS platform and targets a wide range of file extensions.
TECHNICAL DETAILS
Cicada3301 is a new ransomware variant, first seen in June 2024 and has been active in exploiting vulnerabilities in small to medium-sized businesses (SMBs). This ransomware is written in Rust, allowing it to operate on both Windows and Linux/ESXi platforms, showcasing its versatility and broader attack surface. Cicada3301 operates under a ransomware-as-a-service (RaaS) model, with its developers actively recruiting affiliates on underground forums.
Cicada3301 incorporates several advanced features from BlackCat, such as using ChaCha20 for encryption and manipulating system utilities like fsutil, IISReset.exe, and wevtutil to disrupt system recovery and erase traces of its activity. Additionally, it can execute remote commands using embedded credentials via PsExec, enhance network traffic capacity for malicious operations, and terminate processes related to backup and recovery to prevent data restoration.
The ransomware specifically targets a range of 35 file extensions important to enterprise operations, ensuring the encryption of valuable data, including: sql, doc, rtf, xls, jpg, jpeg, psd, docm, xlsm, ods, ppsx, png, raw, dotx, xltx, pptx, ppsm, gif, bmp, dotm, xltm, pptm, odp, webp, pdf, odt, xlsb, ptox, mdf, tiff, docx, xlsx, xlam, potm, and txt.
The use of the EDRSandBlast tool was also used by Cicada3301 to exploit vulnerabilities in signed drivers, a technique previously used by the BlackByte group, to evade endpoint detection and response (EDR) systems.
INDICATORS OF COMPROMISE (IOCs)
SHA-1:
c08a863c2e5288d4ce2a9d46a725518f12711a7
54a8fe5c70ed0007fdd346a9a75977fd9f8ad24a
RECOMMENDATIONS
Utilize advanced endpoint protection solutions to detect and block ransomware behaviors, including the misuse of legitimate tools for malicious activities.
Ensure all systems and software are regularly updated to patch vulnerabilities that could serve as entry points for ransomware.
Maintain frequent backups of critical data, and regularly test recovery processes to confirm they are effective in ransomware scenarios.
Implement network segmentation to contain the spread of ransomware within isolated network segments.
Enforce policies that restrict the execution of scripts, such as PowerShell, that attackers commonly exploit.
Conduct user training to raise awareness of phishing risks and strengthen defenses against social engineering attacks.
Deploy continuous monitoring tools to identify early indicators of compromise and enable rapid response to mitigate threats.
Secure and monitor the use of administrative tools like PsExec, ensuring that management interfaces are not publicly accessible.
A new malware campaign was recently identified, which leverages Google Sheets as a command-and-control (C2) platform. This campaign impersonates a tax authority from government agencies across Europe, Asia, and the United States. The threat actors are targeting more than 70 organizations worldwide, utilizing a custom-made tool named Voldemort. This tool is specifically engineered to exfiltrate data and deploy additional malicious payloads. The campaign’s scope spans a wide array of sectors, including insurance, aerospace, transportation, academia, finance, technology, industrial manufacturing, healthcare, automotive, hospitality, energy, government, media, telecommunications, and social welfare organizations.
TECHNICAL DETAILS
A recent report by Proofpoint highlights a sophisticated phishing campaign in which attackers craft emails tailored to the geographic location of the targeted organization, utilizing publicly available information. These emails impersonate communications from the organization’s national tax authority, purportedly providing updated tax information and including links to relevant documents. When recipients click on the provided link, they are redirected to a landing page hosted on InfinityFree, with the page URL masked by Google AMP Cache. The page features a “Click to view document” button, which, upon interaction, checks the browser’s User Agent. If the browser is running on a Windows operating system, the victim is redirected to a search-ms URI (Windows Search Protocol) linked to a URI tunneled through TryCloudflare. Alternatively, users operating on non-Windows platforms are directed to an empty Google Drive URL, which does not deliver any malicious content.
When the victim interacts with the search-ms file, Windows Explorer is activated, presenting a LNK or ZIP file that is deceptively labeled as a PDF document. The use of the search-ms URI in recent phishing campaigns has become increasingly common due to its ability to mislead victims into believing that the file resides locally in their Downloads folder, when in fact it is hosted on an external WebDAV/SMB share. Opening this file initiates the execution of a Python script from another WebDAV share, without actually downloading it to the host machine. This script profiles the victim by collecting system information, all while displaying a decoy PDF to obscure its malicious operations. Concurrently, the script downloads a legitimate Cisco WebEx executable (CiscoCollabHost.exe) alongside a malicious DLL (CiscoSparkLauncher.dll), which subsequently loads the Voldemort malware through DLL side-loading.
Voldemort, a backdoor developed in C, offers a comprehensive array of commands and file management capabilities, including data exfiltration, deployment of additional payloads, and file deletion. A notable aspect of Voldemort is its utilization of Google Sheets as its command and control (C2) server. The malware periodically contacts Google Sheets to receive new commands and uploads exfiltrated data into specific cells within the spreadsheet. These cells are identified using unique identifiers, such as UUIDs, to enable efficient management and isolation of compromised systems. Voldemort communicates with Google Sheets via Google’s API, utilizing an embedded client ID, secret, and refresh token stored in its encrypted configuration. This approach provides a highly reliable and resilient C2 channel, minimizing the likelihood of network communication being detected by security systems. Additionally, the pervasive use of Google Sheets in enterprise settings makes it impractical to block the service, thereby enhancing the malware’s stealth capabilities.
Implement advanced email filtering to detect and block phishing emails, especially those impersonating trusted entities like tax authorities.
Regularly train employees on how to recognize phishing attempts and suspicious links, particularly those that redirect to unexpected domains.
Use network monitoring tools to detect unusual traffic patterns, such as unexpected communication with Google Sheets or other cloud-based services.
Deploy and update endpoint detection and response (EDR) solutions to identify and block malicious scripts, unusual process executions, and unauthorized file activities.
Limit the execution of macros, scripts, and URI protocols like search-ms, which can be exploited by malware to deliver payloads.
Ensure that access to cloud services like Google Sheets is monitored and controlled through security policies and access restrictions.
Keep all software, especially operating systems and productivity tools, updated to protect against known vulnerabilities.
SonicWall issued patches for a critical vulnerability (CVE-2024-40766) affecting its firewalls. The flaw could allow unauthorized access and potentially crash the device if exploited.
Risk Score
CVE-ID CVSSv3
CVE-2024-40766 9.3
VULNERABILITY DETAILS
This critical CVE-2024-40766 could lead to unauthorized access to the devices. This vulnerability stems from improper access control within the SonicOS management interface, potentially leading to unauthorized resource access and, under specific conditions, causing the firewall to crash.
The vulnerability severity score is 9.3, due to its network-based attack vector, low attack complexity, and the fact that it requires neither authentication nor user interaction to be exploited.
AFFECTED PRODUCTS
SonicWall Firewall Gen 5 devices (SOHO): 5.9.2.14-12o and older versions
SonicWall Firewall Gen 6 devices: 6.5.4.14-109n and older versions
SonicWall Firewall Gen 7 devices running SonicOS 7.0.1-5035 and earlier versions
RECOMMENDATIONS
Apply the latest security patches released by SonicWall.
SOHO (Gen 5 Firewalls) – 5.9.2.14-13o
Gen 6 Firewalls – 6.5.2.8-2n (for SM9800, NSsp 12400, and NSsp 12800)
Gen 6 Firewalls – 6.5.4.15.116n (for other Gen 6 Firewall appliances)
Note: Any SonicOS version higher than 7.0.1-5035 for Gen 7 devices. (This vulnerability is not reproducible in SonicOS firmware version higher than 7.0.1-5035. However, SonicWall recommends to install the latest firmware.)
If immediate patching is not possible, restrict firewall management access to trusted sources.
Disable firewall WAN management access from internet sources as an additional precaution.
Keep an eye on firewall logs and monitor for any unusual access attempts or crashes
