New Ransomware Attack Targets Japan

What's worse than ransomware? Ransomware that hides a disk wiper. And the latest attack is actually worse than that.

Japanese companies have been hit by a ransomware attack that's being called "ONI," named for the file extension it gives to encrypted files. All the files in a particular sub-directory are encrypted into a single file. Then an HTML file is placed in the directory with instructions on how the ransom can be paid.

One of the interesting things about the attack is that there are actually two versions of the ONI encryptor. One performs as just described. The other, dubbed MBR-ONI, also encrypts the master boot record of the infected computer. This is a much more serious attack.

Why two versions?
The "standard" version of ONI operates on computers that did not contain critical information -- such as network active directory servers. MBR-ONI was saved for computers that did have those types of critical information on them. The difference in attacks and attacked computers leads to some interesting inferences about the attack itself.

First, in order for the attackers to decide which systems deserved which attack, they had to be on the computer snooping around for at least some period of time. Researchers have concluded that ONI was active for between 3 and 9 months on infected machines. During that time, the attackers were looking for credentials and other sensitive organizational information, and mapping network topologies.

Next, the attackers sent a group policy across the network to delete event logs and launch the ONI encryption routines. It is generally accepted that both of these actions were aimed at covering the electronic tracks of the attackers -- any money made from ransom payments is purely incidental.

A RAT in the network
ONI entered the organization through a spear-phishing campaign using bogus Microsoft Office documents generally disguised as invoices. When opened, these used a VB script to place a Remote Access Trojan(RAT) on the infected system -- a RAT that would spread laterally through the organization using techniques similar to that in EternalBlue, an exploit developed by the NSA and released in the Vault7 disclosure on WikiLeaks.

The ONI attack makes use of at least two programs with legitimate purposes: the Ammyy Admin remote administration tool and DiskCryptor, which organizations use to legitimately encrypt files for security and privacy purposes.

There are three factors in the ONI attacks, which so far are only targeting organizations in Japan, that companies around the world might find disturbing. First, it seems likely that this is the latest in a string of ransomware attacks aimed at very specific nations or regions. This suggests that ransomware is increasingly being used as a weapon rather than a tool for criminal enterprise.

Second, ONI uses ransomware more as a tool for covering an attacker's tracks and true purposes rather than as a criminal act in and of itself. The problem here is that a group that wants to cover its tracks rather than make money has very little incentive to actually produce the keys to un-encrypt files. Any files affected could very easily be lost forever in such an attack.

Which brings us to the third concern. Backup and recovery routines are seen as a sovereign panacea for ransomware attacks. But if the attackers had months to be planting files in a system (as they did in these cases), then infections could easily extend back in time beyond a point at which backup files could be useful. There are limits to backups, and a long infectation can easily test or break those limits.

Lessons for computer professionals are largely those covered in previous attacks: Train users on anti-phishing protocols, have effective anti-malware technology and policies in place, utilize IDS/IPS technology, and (in spite of the last point, above) make sure that your backup and recovery routines are rock solid.

ONI, like Bad Rabbit and NotPetya before it, is a harbinger of things to come. Learn from the misfortune of others and be prepared for the next major ransomware attack.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.