Lazarus Group Shifts Gears with Custom Ransomware

Lazarus Group, a prominent advanced persistent threat (APT) group linked to North Korea, is behind a little-known strain of ransomware used in attacks earlier this year. Its creation and distribution of VHD ransomware indicates a shift in strategy, report researchers who have been watching it.

VHD ransomware was leveraged in attacks against two organizations in March and April 2020, Kaspersky researchers report. The victims, one located in France and another in Asia, are both large companies in different industry verticals. This ransomware was the main factor tying them together, and analysts noticed a few traits that led them to the Lazarus Group attribution.

The malware itself "doesn't stand out of the ordinary," says Ivan Kwiatkowski, senior security researcher with Kaspersky. "During our first encounter with it, we felt like it was definitely recent and lacking in maturity."

In a description of this first attack, researchers say VHD is written in C++ and crawls connected disks to encrypt files and delete folders called System Volume Information, which are linked to Windows' restore point feature. The malware stops processes that could lock important files, such as Microsoft Exchange and SQL Server. The way operators implemented cryptography is "very unorthodox and not state-of-the-art," though it's not breakable, Kwiatkowski explains.

What reminded them of APT campaigns in this incident was use of a spreader utility hardcoding victim credentials. This propagated the ransomware inside the network and held administrative credentials and IP addresses specific to the victim. The utility used these credentials to brute-force the Server Message Block (SMB) service on every machine it found; when a connection was made, VHD was copied and executed via WMI calls.

"This is not a TTP [tactics, techniques, and procedures] we usually observe with cybercrime threat actors who will usually rely on pen testing techniques to go straight after the victim's Active Directory infrastructure and achieve total control over the network," Kwiatkowski adds. This technique reminded researchers of APT campaigns SonySPE, Shamoon, and OlympicDestroyer, all wipers with worming capabilities.

The attack didn't fit the pattern of traditional ransomware campaigns. Researchers found VHD was not widespread and only found a few samples in their telemetry and a few public references. This indicates it's not traded in market forums, which is usually how it's monetized.

Soon after, Kaspersky's Incident Response Team handled another attack involving VHD. They believe attackers exploited a vulnerable VPN gateway to gain access; from there, they obtained administrative privileges, deployed a backdoor, and took over the Active Directory server. This enabled them to deploy VHD to all machines in the network over the course of 10 hours.

This attack did not employ a spreading utility but instead deployed VHD through a downloader that is still believed to be in development. "In all likelihood, the attackers felt like that had controlled a big enough portion of the victim's network and that they didn't need to resort to such noisy methods to distribute the ransomware to all the victim machines," Kwiatkowski says.

The backdoor is an instance of a multiplatform framework dubbed MATA. As far as researchers know, Lazarus Group is the sole owner of MATA, leading to its attribution as the owner and operator of VHD ransomware. They do not believe VHD is in use among other criminal groups.

However, there have been other public mentions of VHD ransomware in specialized blogs, indicating there have been other attacks they're unaware of. Lazarus Group's role as the sole owner and distributor of VHD indicates it may be experimenting with new tactics.

A Shift in Strategy
Lazarus Group has always focused on financial gain but has traditionally been involved with banking and fraud targeting the SWIFT financial network, Kwiatkowski says. While the group's motivations haven't changed, he suspects news on targeted ransomware has reminded attackers how lucrative these attacks can be.

Its move to create and deploy custom ransomware is at odds with what researchers know about the ransomware ecosystem, which usually involves several independent groups with no links beside their business connections. The group behind an initial intrusion usually isn't the same group that compromised a victim's Active Directory server, which is not the group that wrote the ransomware code used in an attack, Kaspersky researchers say in a blog post.

In these attacks, Lazarus Group has also avoided common steps in ransomware attacks: Its attackers don't seem to be looking for backups, they're not looking at financial documents to set an appropriate ransom price, and they're not threatening to leak internal information.

While there is no clear reason why Lazarus Group is going solo, researchers predict it's trying to boost financial gain. It's obvious, they say, the group won't be able to match others' efficiency.

"We hypothesize that Lazarus is trying to handle all these roles by itself, because it is their perceived way of cutting middlemen and maximizing profits," Kwiatkowski says. "We'll look at future incidents closely, as it will indicate whether this strategy paid off for them."

Related Content:

Register now for this year's fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for details on conference information and to register.