Ragnar Locker Ransomware Hits Customer Care Giant TTEC

On September 14, 2021, TTEC sent an internal message to its employees about a widespread system outage that began on September 12. Later that evening, TTEC confirmed that the outage was a ransomware attack by the notorious Ragnar Locker group. The TTEC administration also shared a screen-grab of the notice to its employees.

TeleTech Holdings Incorporated, better known by its acronym, TTEC, handles the customer experience for most of the world’s largest brands, including Credit Karma, Bank of America, Best Buy, Dish Network, Kaiser Permanente, Verizon, and USAA.

Recent Development

The US Federal Bureau of Investigation (FBI) reports that Ragnar Locker ransomware has breached the networks of at least 52 organizations in multiple critical infrastructure sectors. We urge organizations to review the provided indicators of compromise (IOCs) to detect and block Ragnar Locker ransomware attacks.

Securin’s Ransomware Reports Called Out the Vulnerability

In February 2021, Securin had issued a warning about the CVE in its Ransomware Spotlight Report 2021, when the vulnerability was associated with five ransomware families, including WannaCry.

Updates in the Ransomware Spotlight Report 2021 Q1 point to the CVE being used by the APT group, Viking Spider. which, in turn, is associated with and known to use Ragnar Locker ransomware.

CVE Findings

Securin’s expert pentesters and research analysts have analyzed the vulnerability leveraged by Ragnar Locker ransomware.

CVE-2017-0213

CVE-2017-0213, also known as a Windows COM Elevation of Privilege Vulnerability, allows attackers to gain elevation of privilege when they run a specially crafted application on any version of Windows between 2016 and Windows 10.
As it is a medium-severity flaw with a CVSS v3 score of 4.7, it can be overlooked by administrators; it has been a major concern since 2017.
The CVE also has remote code execution (RCE) and privilege escalation (PE) capabilities.
The vulnerability is also associated with five ransomware families, namely, Petya, Phobos, Neifilim, Mailto, and Wannacry, apart from Ragnar Locker.
The CVE has also been exploited multiple times by three APT groups: APT28, APT33, and APT41.

Unlocking Ragnar Locker

Here is a cheat sheet with information about Ragnar Locker ransomware.

Ragnar Locker Ransomware Cheat Sheet
Ragnar Locker was first discovered in December 2019. It is known to use a ‘double extortion’ tactic; the attacker exfiltrates sensitive data first and then encrypts all files, threatening to leak the data if the ransom is not paid. Ragnar Locker uses a Salsa20 file encryption algorithm. It also uses an RSA-2048 algorithm to encrypt file keys. Some prominent victims of Ragnar Locker ransomware include computer memory maker, ADATA, corporate travel firm, CWT, Japanese game publisher, Capcom, Italian liquor maker, Campari, and French aerospace firm, Dassault Falcon Jet. Ragnar Locker changed their tactics when they announced that victims who seek the FBI’s help would have their files leaked. Ragnar Locker is also known to be associated with the advanced persistent threat (APT) group, Viking Spider.

Ragnar Locker Ransomware Cheat Sheet

Ragnar Locker was first discovered in December 2019.
It is known to use a ‘double extortion’ tactic; the attacker exfiltrates sensitive data first and then encrypts all files, threatening to leak the data if the ransom is not paid.
Ragnar Locker uses a Salsa20 file encryption algorithm. It also uses an RSA-2048 algorithm to encrypt file keys.
Some prominent victims of Ragnar Locker ransomware include computer memory maker, ADATA, corporate travel firm, CWT, Japanese game publisher, Capcom, Italian liquor maker, Campari, and French aerospace firm, Dassault Falcon Jet.
Ragnar Locker changed their tactics when they announced that victims who seek the FBI’s help would have their files leaked.
Ragnar Locker is also known to be associated with the advanced persistent threat (APT) group, Viking Spider.

Ragnar Locker Attack Methodology

The attack methodology incorporated by Ragnar Locker ransomware was analyzed by our researchers. Here are their findings:

The threat actor begins the attack by compromising the target company’s network via RDP service using brute-force, hoping to uncover weak passwords or steal credentials.
Second-stage reconnaissance is carried out after successful initial access is established.
CVE-2017-0213, a Windows COM Aggregate Marshaler vulnerability is exploited to escalate privileges.
After privilege escalation, the attacker deploys a virtual machine hosting platform called VirtualBox along with a WindowsXP image, so that it can evade detection and start its ransomware encryption program. This technique is also used by the Maze ransomware operators.
A specially-crafted VM file is loaded onto the VirtualBox to help map all local drives. This file allows the ransomware process running within the VM to encrypt all files. This encryption process appears to be a trusted one to administrators on the host security team and is usually ignored by security protocols.
Ragnar Locker operators then delete any shadow copies left after the encryption process and disable antivirus software from detecting and imposing countermeasures.
A PowerShell script is used to move laterally from one network asset to another.
Before launching their ransomware, the attackers steal sensitive information and upload them to multiple servers to publish them if the ransom is not paid.
The ransomware is then deployed onto the host network.

Ragnar Locker MITRE Map

IoCs for Ragnar Locker
MD5(packed): 6d122b4bfab5e75f3ae903805cbbc641 SHA256(packed): 68eb2d2d7866775d6bf106a914281491d23769a9eda88fc078328150b8432bb3 MD5: 6360b252b21fe015d667b093f6497e33 SHA256: 1de475e958d7a49ebf4dc342f772781a97ae49c834d9d7235546737150c56a9c ragnar_{computer_id} .keys RGNR_{computer_id}.txt http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E http://p6o7m73ujalhgkiv.onion/?page_id=171 http://rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion/ http://rgleak7op734elep.onion/

IoCs for Ragnar Locker

MD5(packed): 6d122b4bfab5e75f3ae903805cbbc641
SHA256(packed): 68eb2d2d7866775d6bf106a914281491d23769a9eda88fc078328150b8432bb3
MD5: 6360b252b21fe015d667b093f6497e33
SHA256: 1de475e958d7a49ebf4dc342f772781a97ae49c834d9d7235546737150c56a9c
ragnar_{computer_id}
.keys
RGNR_{computer_id}.txt
http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E
http://p6o7m73ujalhgkiv.onion/?page_id=171
http://rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion/
http://rgleak7op734elep.onion/

Increasing Awareness to Prevent Ransomware Attacks

As the TTEC story is still evolving, the extent and severity of the impact is not certain. Immediately after the attack, TTEC disconnected their systems, a move that can be beneficial in containing the spread of the ransomware to partner networks. The full impact of the event will be uncovered in the months to come.

With a spike in the number of ransomware attacks making the headlines since the Colonial Pipeline attack in May 2021, the JBS attack in June 2021, and the REvil Kaseya attack in July 2021, being aware of how susceptible organizations are to ransomware attacks is the need of the hour.

We urge organizations to upgrade their servers, update their software, and carry out regular ransomware assessments to ensure that their systems are protected against the devastation of a ransomware attack.

Securin’s in-depth research helps organizations become more resilient against ransomware. We recommend that organizations get a Ransomware Assessment to identify gaps, understand exposure, and become resilient to ransomware attacks in the future.