{"id":7391,"date":"2022-05-30T12:00:34","date_gmt":"2022-05-30T19:00:34","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7391"},"modified":"2023-04-05T12:33:01","modified_gmt":"2023-04-05T19:33:01","slug":"43-apt-groups-use-ransomware-to-attack-their-targets","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/43-apt-groups-use-ransomware-to-attack-their-targets\/","title":{"rendered":"43 APT Groups Use Ransomware to Attack Their Targets"},"content":{"rendered":"

Securin\u2019s quarterly report on ransomware metrics reveals that three new APT groups are using ransomware to mount attacks on their targets, bringing the total number of APT groups using ransomware to 43.<\/strong><\/p>\n

Securin\u2019s quarterly report recently recorded a 7.6% spike in vulnerabilities tied to ransomware, increasing the total number of vulnerabilities from 288 to 310. Quarter 1 of 2022 also saw an increase in the number of APT groups from 40 to 43. In this blog, we will explore in detail the threat posed by APT groups and how using ransomware in their arsenal has made them the most dangerous adversary for critical organizations around the world.<\/p>\n

Active APT Groups Operating from Specific Regions<\/em><\/span><\/p>\n

\"\"<\/p>\n

New APT Groups Using Ransomware<\/h2>\n

The newly identified APT groups using ransomware to target their victims in Q1 2022 are DEV-0401 (China), APT35 (Iran), and Exotic Lily.<\/p>\n

APT35<\/h3>\n

APT35 is an Iranian government-sponsored threat actor group. The group is known for targeting Middle Eastern countries, the United States, and industries such as finance, medical research, energy, chemicals, and telecommunications to collect strategic intelligence.<\/p>\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n\n\n\n
\n

\u00a0APT35<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n

\n

Vulnerabilities Used<\/p>\n<\/td>\n

\n

CVE-2021-44228 (Apache Log4j) + 15 other vulnerabilities<\/p>\n<\/td>\n<\/tr>\n

\n

Ransomware Deployed<\/p>\n<\/td>\n

\n

Memento<\/p>\n<\/td>\n<\/tr>\n

\n

Payloads Used<\/p>\n<\/td>\n

\n

CharmPower backdoor<\/p>\n<\/td>\n<\/tr>\n

\n

Other Malware Deployed<\/p>\n<\/td>\n

\n

MANGOPUNCH, DRUBOT, ASPXSHELLSV, PUPYRAT, TUNNA, BROKEYOLK, and HOUSEBLEND<\/p>\n<\/td>\n<\/tr>\n

\n

Operative Since<\/p>\n<\/td>\n

\n

2013<\/p>\n<\/td>\n<\/tr>\n

\n

Aliases<\/p>\n<\/td>\n

\n

Ajax Security Team, NewsBeef, Phosphorus, TA453, and Newscaster<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Previous Attacks<\/strong><\/p>\n

APT35 deployed credentials-stealing malware<\/a> in oncology, genetic, and neurology research organizations in the United States and Israel, targeting senior medical professionals and their research information. Spear phishing and custom malware are among an array of tactics the group uses against victims. The group also tried to disrupt election campaigns<\/a> in the 2020 US presidential elections by deploying spear phishing messages to campaign officials\u2014although it did not cause much damage. APT35 is known to conduct mass exploitation attacks using the Microsoft Exchange Server vulnerability<\/a> on their target networks.<\/p>\n

Exotic Lily<\/h3>\n

The Exotic Lily APT group uses CVE-2021-40444<\/a> to target its victims and is tied to Conti ransomware. This group acts as an Internet Access Broker (IAB), i.e., steals credentials from organizations and sells them to the highest bidder. It was discovered by the Google Threat-Analysis group. So far, the techniques they have used involve email campaigns and file sharing software.<\/p>\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n\n\n
\n

Exotic Lily<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n

\n

Vulnerabilities Used<\/p>\n<\/td>\n

\n

Microsoft Windows MSHTML platform (CVE-2021-40444<\/a>)<\/p>\n<\/td>\n<\/tr>\n

\n

Ransomware Deployed<\/p>\n<\/td>\n

\n

Conti and Diavol<\/p>\n<\/td>\n<\/tr>\n

\n

Payloads Used<\/p>\n<\/td>\n

\n

BazarBackdoor payloads and Bumblebee<\/p>\n<\/td>\n<\/tr>\n

\n

Associated APT Groups<\/p>\n<\/td>\n

\n

Wizard Spider<\/p>\n<\/td>\n<\/tr>\n

\n

Operative Since<\/p>\n<\/td>\n

\n

September 2021<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Previous Attacks<\/strong><\/p>\n

Exotic Lily first started exploiting the Microsoft MSHTML zero day (CVE-2021-40444<\/a>) in September 2021. The group then began to actively impersonate employees from companies and delivered payloads containing malware<\/a> to steal various system details such as the OS versions, user names, and domain names, which are then exfiltrated in the JSON format to a C2. The group has been targeting specific industries such as IT, cybersecurity, and healthcare.<\/p>\n

<\/h3>\n

DEV-0401<\/h3>\n

DEV-0401, a Chinese ransomware attack group, also actively exploited the Log4j vulnerability<\/a> (CVE-2021-44228) and installed the Night Sky ransomware to extort data from vulnerable servers on the internet.<\/p>\n\n\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n
\n

DEV-0401<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n

\n

Vulnerabilities Used<\/p>\n<\/td>\n

\n

CVE-2021-26084<\/p>\n

CVE-2021-34473<\/p>\n

CVE-2021-44228<\/p>\n<\/td>\n<\/tr>\n

\n

Ransomware Deployed<\/p>\n<\/td>\n

\n

Night Sky, LockFile, AtomSilo, Rook, and Khonsari<\/p>\n<\/td>\n<\/tr>\n

\n

Operative Since<\/p>\n<\/td>\n

\n

December 2021<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Previous Attacks<\/strong><\/p>\n

DEV-0401 has previously deployed multiple ransomware families, including LockFile, AtomSilo, and Rook, and has similarly exploited internet-facing systems running Confluence (CVE-2021-26084<\/a>) and on-premise exchange servers (CVE-2021-34473<\/a>). The group has used command and control (CnC) servers that spoof legitimate domains.<\/p>\n

Although some APT groups are state-sponsored, they have not shied away from targeting other organizations in the private sector. Today, APT groups are more organized, even adopting 9 to 5 job operations, providing employee benefits, and exploiting multiple vulnerabilities. Organizations, private or public, need to be vigilant and deploy adequate measures to ensure that these groups do not take advantage of them.<\/strong><\/p>\n

We have analyzed the latest vulnerabilities, threats, and techniques used by the ransomware groups and compiled a detailed ransomware report<\/a>. Securin offers Ransomware Attack Surface Assessment<\/a> to detect vulnerabilities open to ransomware attacks. You can also check out our other services <\/a>and contact us if you want to build a strong defense of your network architecture.<\/p>\n","protected":false},"excerpt":{"rendered":"

CSW\u2019s quarterly report on ransomware metrics reveals that three new APT groups are using ransomware to mount attacks on their targets, bringing the total number of APT groups using ransomware to 43. Read more on them here.<\/p>\n","protected":false},"author":1,"featured_media":14351,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[80,117],"tags":[544,107,546,545,91],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7391"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/comments?post=7391"}],"version-history":[{"count":6,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7391\/revisions"}],"predecessor-version":[{"id":14920,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7391\/revisions\/14920"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/14351"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=7391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/categories?post=7391"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/tags?post=7391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}