Troubling New Disk-Level Encryption Ransomware Surfaces

A new ransomware strain is implementing a troubling but so far relatively rarely used technique to encrypt data in a target environment.

Instead of encrypting files on endpoint systems like most ransomware families, the new malware, dubbed "DeepBlueMagic," targets different disk drives on a target organization's servers, researchers from Heimdal Security say.

The malware was observed using a legitimate third-party encryption tool called BestCrypt Volume Encryption from Jetico to start encryption on all drives — except the primary system drive (“C:\”) — on an infected Windows Server 2012 R2 system.

Heimdal found the encryption tool, along with a rescue file (rescue.rsc) that Jetico's software typically uses to recover damaged partitions, on the system drive of the infected machine. In this instance, however, the rescue file was encrypted as well and required a password to open it, according to Heimdal's new report.

The security vendor was not able to determine how attackers might have gained initial access to the compromised system, nor was it able to obtain a sample of the original executable file because the ransomware deleted itself from the system.

Heimdal's investigation showed that DeepBlueMagic had started the encryption process on the infected system's D:\ drive and almost immediately stopped the process after initiation. This resulted in the drive being partially encrypted and turned into a RAW partition — that is, basically, a partition where the file system structure has been corrupted and therefore not recognized by the system.

"Any access attempt would have the Windows OS interface prompt the user to accept formatting the disk since the drive looks broken once encrypted," Heimdal says in its report. Usually, the rescue file that Jetico's encryption software uses could have been used to restore the partially encrypted drive, but in this case that was not possible because the rescue file had been encrypted as well.

As is the case with many ransomware strains these days, DeepBlueMagic is designed to disable any behavior-based threat detection tools that might be present on a targeted server — before the malware starts any encryption. Its approach for doing it is to stop all third-party Windows services on the system. Once the malware finishes encryption, it deletes the Windows Volume Shadow copy to make restoration impossible from encrypted drives. As a final flourish, the malware that Heimdal investigated leveraged its presence on a Windows server to try and activate Microsoft's BitLocker encryption software on all endpoints in the victim organization's Active Directory.

Heimdal did not immediately respond to a Dark Reading request seeking clarification on why the attackers might have turned off the encryption almost immediately after initiating it and to other questions. The company says its malware analysts were able to restore files on the infected system using a freely available decryption tool from CGSecurity.org.

A Very Effective Tactic
Dirk Schrader, global vice president security research at Netwrix-owned New Net Technologies, describes the tactics used by DeepBlueMagic as adding a new wrinkle to ransomware attacks. "File-based encryption has the tendency to be discovered during the process, especially when a larger number of files are to be encrypted," Schrader says. "Encrypting the volume is a different, more versatile approach here as it can also easily span across RAID levels, being agnostic to the physical aspects of the RAID system."

The approach can help speed infection, especially considering DeepBlueMagic's ability to stop all third-party services on a Windows machine, he says. Schrader says it's possible that what Heimdal encountered was an early trial of a new approach. "If seen as successful, it will be tuned and perfected to become more powerful," he warns.

Disk-level encryption is not new but is less frequently used than file-level encryptions, says Alec Alvarado, threat intelligence team lead at Digital Shadows. The approach is effective because the system itself is rendered almost useless and inaccessible. While many ransomware groups these days surgically pick and choose the files they want to encrypt, disk-level encryption removes access to everything on a system, he says.

"Given the use of legit disk encryption software that is publicly available, the attackers may have taken this approach simply because it required less development effort," Alvarado says. He points to the Mamba ransomware group — an outfit that's been operating since at least 2016 — as using a similar disk-level encryption approach in attacks earlier this year. As with the operators of DeepBlueMagic, the Mamba group also used a publicly available encryption tool called DiskCryptor to encrypt data.

"Disk-level encryption combined with the ability to delete shadow copies makes restoring an impacted system extremely difficult without the decryption key," Alvarado notes. "In this particular case, it seems as if there is a decryption tool publicly available for the DeepBlueMagic ransomware."