Ransomware Andariel attacks with DTrack and Maui The Andariel group attacks companies with several malicious tools. Hugh Aver August 11, 2022 Our experts investigated the activity of Andariel, believed to be a subgroup of the Lazarus APT group. Cybercriminals use DTrack malware and Maui ransomware to attack businesses worldwide. As it’s typical for Lazarus, the group attacks for financial gain — this time through ransom demands. Targets of Andariel attacks Our experts concluded that, instead of focusing on any particular industry, the Andariel group is ready to attack any company. In June, the US Cybersecurity and Infrastructure Security Agency (CISA) reported that Maui ransomware targets mainly companies and government organizations in the US healthcare sector. However, our team also detected at least one attack on a housing company in Japan, as well as several victims in India, Vietnam and Russia. Andariel tools The Andariel group’s primary tool is the long-established malware, DTrack. It collects information about a victim and sends it to a remote host. Among other things, DTrack collects browser history and saves it to a separate file. The variant used in Andariel attacks is able not only to send the harvested information to the cybercriminals’ server via HTTP, but to store it on a remote host in the victim’s network. When the attackers find noteworthy data, Maui ransomware comes into play. It’s generally detected on attacked hosts 10 hours after DTrack malware activation. Our colleagues from Staiwell have studied its samples and concluded that the ransomware is controlled manually by the operators — that is, they specify which data to encrypt. Another tool the attackers appear to be using is 3Proxy. This legitimate, free, cross-platform proxy server is likely of interest to attackers due to its compact size (only a few hundred kilobytes). This type of tool can be used to maintain remote access to a compromised computer. How Andariel spreads its malware The cybercriminals exploit unpatched versions of public online services. In one such case, the malware was downloaded from an HFS (HTTP file server): the attackers used an unknown exploit that enabled them to run a Powershell script from a remote server. In another, they were able to compromise a WebLogic server through an exploit for the CVE-2017-10271 vulnerability, which ultimately allowed them to run a script. For a more detailed technical description of the attack and the tools involved, along with indicators of compromise, see our Securelist post. How to stay safe? First of all, make sure that all corporate devices, including servers, are equipped with robust security solutions. In addition, it would be wise to devise an anti-ransomware strategy and measures in advance just in case you do get infected.
Read next DogWalk and other vulnerabilities Microsoft has released patches for more than 140 vulnerabilities, some of which need to be closed as soon as possible.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.
Tips Nine reasons to set up a VPN on your router Get the most speed, reliability, and convenience out of your VPN by putting it on your router. Here’s a look at the real benefits of specific VPN setup scenarios for your whole home network.
Tips Fact and fiction about hidden Wi-Fi network names Hiding your Wi-Fi network name might seem like a smart security move, but in practice it does more harm than good. Let’s take a look at how it works, what side effects it can have, and how to properly secure your home Wi-Fi.