Reverse Engineering Ransomware Tactics in Critical Infrastructure Attacks
In early May 2020, as COVID-19 pandemic restrictions eased and daily life began to return to normal, we celebrated several consecutive days of zero new cases. However, businesses and organizations worldwide face cyberattacks every single day. During this period, an unprecedented ransomware known as ColdLock quietly targeted Taiwan's energy and semiconductor industries.
FromMITRE ATT&CKTechniques Used
Based on intelligence reports and news summaries, the specific entry method for ColdLock remains unknown. According to the MITRE ATT&CK framework, it may have utilized TA0001 common Initial Access techniques, such as:
- T1133External Remote Services (VPN)
- T1193Spearphishing
- T1190Exploitation of high-risk vulnerabilities in public-facing applications.
The MITRE ATT&CK techniques observed in ColdLock's behavior are illustrated in the diagram below.
Technical Analysis
Since the ransomware involved in this attack lacks any lateral movement or command-and-control (C2) communication capabilities, it is highly likely that it was deployed via PowerShell through Active Directory Group Policy Objects (GPO).
Loading the payload via .NET Reflection:
The ransomware payload is a CLR DLL protected by ConfuserEx. Based on the compilation timestamp, it was created in Taiwan on May 3, 2020, shortly after 7:00 PM. Like other samples from similar ransomware attacks, it was compiled within 24 hours of the
actual attack.
ConfuserEx AntiTamper snippet (Normal mode).
Main entry point logic:
If the operating system is Windows 10, it first disables Push Notifications and Windows Defender to avoid detection:
It generates a key pair, which also serves as the ransom ID for the user, and will later be used for file encryption:
It first generates a random 32-byte password,
then encrypts it using an embedded hardcoded RSA key (2048-bit) and encodes it in Base64 to serve as the ransom ID,
Subsequent file encryption uses the SHA-256 hash of the initially generated 32-byte random password as the key,
The ransomware is triggered at 12:10 PM; if the time has not yet been reached, it sleeps for 15 seconds before checking again. This trigger time appears to be consistent across all incidents involving this specific ransomware.
It also searches for mounted drives other than the C: drive, including network drives, to target for encryption.
Even system restore points and the Recycle Bin are targeted.
For certain databases or email software, it will first stop specific services to bypass write protection:
It searches for specific encryption targets, including various databases and mail servers:
Encryption only occurs if three conditions are met: the folder contains fewer than 100 files, the files were last modified in or after 2018, and the files are not on the whitelist.
Skip encryption for specific whitelisted file extensions
dll- ocx
- msi
- iso
- mkv
- mov
- avi
- wmv
- m2ts
- mp3
- tmp
- gif
Skip specific whitelisted directory names from encryption
appdata- temp
- cache
- log
- logs
- resource
- microsoft
- image
- skin
- theme
- res
- script
- setup
- third_party
- thirdparty
- reference
- .git
- lib
If the conditions above are not met (directory contains fewer than 100 files, directory name is not on the whitelist, or the file's last write time is before 2018), only files with the following extensions will be encrypted:
txt- doc
- docx
- xls
- xlsx
- ppt
- pptx
- odt
- hwp
- pst
- sh
- one
- csv
- bak
- lnk
- jpg
- sql
- php
- cpp
- jsp
- java
- zip
- rar
- 7z
- gz
- aspx
- xml
Encrypt files using the AES CBC mode algorithm with the previously generated key:
Samples of attacks by the same ransomware on other industries are almost identical.
The only difference is the embedded RSA key.
Conclusion
Information security is like rice—commonplace, yet absolutely essential.
Many security incidents begin with the compromise of vulnerable servers and computing resources within a corporate IT network. Together with Cisco, we recommend that organizations take the following steps to reduce risk and help ensure the integrity of
operations within their facilities:
1. Before enabling any device, check for and remove all embedded or default passwords, and implement multi-factor authentication whenever possible.
2.Proactively detect system vulnerabilities and ensure all patches and updates are applied in a timely manner. (If a patch is unavailable, consider migrating to new technology.)
3. Vulnerability scanning should evolve into proactive "threat asset management" rather than reactive, exhausting cycles of scanning and patching.
4. Device security controls should take precedence over defensive product matching and blocking; implement endpoint device controls to strictly manage access permissions.
5. Access to core networks or critical operational systems via external internet browsers should be strictly restricted.
6. Organizations should design or implement a set of security technical standards, such as security baselines, including security standards or guidelines for networks, systems, and applications.
7. Regularly review and update network security incident response plans and disaster recovery plans, both routinely and following major cyberattacks.
8. Plan and regularly audit security classification management methods for security zones, such as isolating core systems from the IT network. Ensure there are no direct connections between the two, including network links, laptops, and storage devices.
9. To address the lack of awareness regarding new cybersecurity detection technologies or methods, implement recurring security assessments and red-blue team exercises (RedTeam and BlueTeam).
10. Recommended security operations and considerations:Detection->Analysis->Defense->Adaptabilitydirections.