Collaboration between FIN7 and the RYUK group, a Truesec Investigation
This is an analysis of part of the network of Russian organized crime hacking groups.
This summer Truesec observed an attacker that used the tools and techniques of FIN7, including the CARBANAK RAT, to take over the network of an enterprise. In a subsequent attack almost six weeks later this foothold was used to deploy the RYUK ransomware on the victim network.
This attack marks the first instance Truesec has observed of the combination of FIN7 tools and the RYUK ransomware, indicating a change in pattern for FIN7 attacks. Up until now FIN7 has not been associated with ransomware attacks. This also suggests a closer collaboration between FIN7 and the RYUK group, also known as WIZARD SPIDER or FIN6, than has been previously known by Truesec.
It is possible FIN7 simply sold the access to the RYUK group, but it is probable that FIN7 and WIZARD SPIDER are more closely affiliated and may be part of the same organized crime network.
Threat actors are constantly evolving and changing their methods. FIN7 is a financially motivated threat group that in the past has targeted the retail, restaurant, and hospitality sectors since mid-2015. They are known to use the CARBANAK RAT for mail-hijacking and point-of-sale attacks.
This summer Truesec observed an attacker that used the tools and techniques of FIN7, including the CARBANAK RAT, to take over the network of an enterprise. Later this foothold was used to deploy the RYUK ransomware on the victim network.
This attack marks the first instance Truesec has observed of the combination of FIN7 tools and the RYUK ransomware, indicating a change in pattern for FIN7 attacks. Up until now FIN7 has not been associated with ransomware attacks.
Given that ransomware is now the preferred technique for financially motivated attacks, it is not surprising that FIN7 also switch to ransomware. The attack also indicates that FIN7 now collaborates with the RYUK group, also known as WIZARD SPIDER or FIN6, in financially motivated attacks.
Stage 1 – The Phishing
The first part of the attack was a phishing email claiming to be from UPS.
Stage 2 – The take over
These functions are clearly later versions of the code illustrated in the article by Morphisec.
Once the attacker had ensured they had admin privileges, they launched RunPsExec against several clients and servers to install a second malicious code, a PowerShell RAT, previously unknown to Truesec. The PowerShell RAT connected to another malicious domain: hxxps://besaintegration[.]com/gate.
The PowerShell RAT includes functions to retrieve basic system information and provides capabilities to start and manage arbitrary commands as background jobs.
The different functions are illustrated below.
The last action the attacker performed at this stage was to also install the CARBANAK RAT as an additional backdoor onto domain controllers of the victim network. The attacker downloaded an obfuscated script that when executed, loads a DLL file in memory and executes it through reflection methods.
It then connects to Command-and-Control server 170.130.55[.]85:443 in order to download the malware configuration file anunak_config which is a known component of the CARBANAK RAT. Once the CARBANAK RAT was installed, it would beacon to the same C2 server.
Once the actor had deployed the PowerShell RAT and CARBANAK RAT, no further action was taken on the compromised network for several weeks.
Stage 3 – The Reconnaissance
The third stage of the attack began several weeks after the initial compromise and lasted about a week. The attacker deployed Cobalt Strike on the network and began reconnaissance and data discovery on the network. This part of the attack was conducted from a completely different infrastructure than the first two stages.
During this stage, the attacker also exfiltrated data from the victim network. The exfiltration was done using the SmartFTP Client that connected to an IP address controlled by the attacker.
The names of some of the files that were exfiltrated were found in the file “Unlocker-List.txt”. This file is part of the IObit Unlocker software, installed by the attacker, likely to facilitate the ransomware execution or file copy operations by unlocking locked files.
Stage 4 – The Ransomware
A week after the attacker had begun reconnaissance of the network and exfiltrated the data they wanted; they deployed the RYUK ransomware. The Ransomware was deployed using both manual and scripted methods.
The high-level description of the staging procedure is summarized below:
- Identify server hostnames and IP addresses in the domain
- Prepare batch file to disable protections and security software (kill.bat)
- Prepare RYUK ransomware (svchost.exe)
- Copy kill.bat
- Disable User Account Control
- Run kill.bat
- Copy RYUK ransomware (svchost.exe)
- Run RYUK ransomware (svchost.exe)
Steps 4-8 were performed on all identified servers in the victim network, using both IP address and hostname. Remote code execution was achieved with two methods: remote WMI command execution and using Microsoft Sysinternals’ utility PsExec.
The subsequent stages, in which data was stolen and a ransomware was deployed, occurred almost six weeks after the initial compromise. This part of the attack was done using tools and techniques that are indicative of the RYUK ransomware group, also known as WIZARD SPIDER or FIN6. This was also conducted from an entirely different infrastructure than the initial stages attributed to FIN7.
The progress of the attack clearly indicates that different stages of the attack were conducted by different teams. It’s possible that the FIN7 group are now more focused on just gaining access and then let a team from the RYUK group take over and deploy ransomware.
This suggests a closer collaboration between FIN7 and the RYUK group than has been previously known by Truesec. It is possible FIN7 simply sold the access to the RYUK group, but it is probable that the two groups have even stronger ties. The RYUK group are known to contract affiliates to gain foothold for their ransomware attacks.
It consequently seems possible that FIN7 and WIZARD SPIDER are now both part of the same sprawling organized crime network.
Appendix – IOC
This is an analysis of part of the network of Russian organized crime hacking groups is written by Threat Intelligence Lead Mattias Wåhlén.
Mattias Wåhlén’s task is to lead and further develop Truesec’s Threat Intelligence capabilities for anticipating data breaches and averting threats. The goal is to map all major actors threatening Swedish and global interests and monitor their activities. Read more.