Hi , good day . I'm sean Gallagher .
I'm a senior threat researcher at
Sophie's labs and uh , this is a
talk on ransom whereby the numbers , uh ,
some of the tactics techniques and
procedures used by dharma ransomware as
a service operators .
First a quick who am I ? Um , I , as I
said , I'm a senior threat researcher
at sofa slabs have been here since
february or virtually since february
since nobody is actually anywhere right
now . Uh , formerly I was the I . T .
Information Security and national
Security editor at Ars Technica . So in
which capacity I attended the last two
Avenger cons as a guest , I'm a former
Navy officer , uh , 1100 Service
warfare until they found out I knew
what a computer was . And then my last
tour of the service before becoming a
government contractor . Then technology
journalist was as an ADP security
officer and network administrator and
command security manager for a special
warfare unit , special boat squadron .
Happy to be here again , virtually wish
I was there with you physically . But
you know , we'll make the best we can
here . I hope so . Just to
review some of the ransomware trends
that we've seen over the past year .
It's been a bad year . It's always been
a bad year for ransomware , but this
year has been a pretty bad year . We've
seen increased use of what we've
typically referred to as gray hat tools
and legitimate software tools for
attacks by ransomware operators . We've
also seen an increase in the size of
ransom demands over the past year .
Number of them have gone up by
100-200% in terms of percentage
against what they were requiring or
demanding last year . We've also seen
it become de rigueur for ransomware
operators to threaten data exposure
to rush along payment of
extortion by their victims .
Some of the common patterns we see in
these attacks are exploitation of rdP
targeted phishing attacks are spear
phishing attacks with mall docks in
them or going to capture credentials
through other means . And the use of
red team tools seen a particular
rise in the use of cobalt strike and
Powershell empire , but especially
cobalt strike over the past year . Uh
and now with pieces of cobalt strike
apparently available for free on gIT
hub in other places . Uh the use of
spreading uh and also we've seen shared
power shell tools used by different
sets of actors and dar Mazz actors are
an example of that , which I'll get to
in a moment . Also , we've seen a
mature ation maturation of business
models for ransomware operators . So
what used to be a shop of people
operating on their own uh using what
and handling their own exploits or
using uh a set of tools they developed
has migrated over the past few years to
subcontracting of deployment of malware .
So things we saw with real last year ,
for example using uh motet and trick ,
but uh to gain access paid access to
victims is continuing and other actors
are getting into the game . We've also
seen a move as with Dharma as
as Dharma has been doing for the past
three years Franchising using
uh affiliate networks to
run attacks . And this helps the
developers of ransomware essentially
get into the business of generating the
back end and no longer need to be doing
customer service dealing with the
victims and getting them to pay .
So Dharma is what we're talking about
today . And Dharma is one of the oldest
ransomware operations still and that is
still active . It's been active since
2017 . Uh it's an entry level sort of
franchise business complete with tools
for your low level ransomware operator
wannabe . And uh because of the way
its run , the ransoms for these attacks
have in the past typically been much
lower than the ransom is demanded by
operations like maize and uh and and
Reville and others . And that's
partially because of the targeting uh
Dharma targets mostly smaller
targets , smaller organizations that
don't have established I . T .
Organizations but that includes smaller
local and state government operations
as well as mid sized businesses that
may not have dedicated I . T . Or may
rely on managed managed services .
Um the uh the
ransomware source code , the source
code for the back end of Dharma and the
generator for its crypto malware was
posted for sale this year on on on a
forum , Russian language forum uh and
it's possibly now being operated by
multiple operators but we believe that
the corps operator is still the largest
and someone used the software , someone
used the source code in an apparent
attack against Iranian government
targets earlier this year based on some
reports I've seen . So this is
Dharma is a ransomware as a service
model . This is how it works that the
developer provides the ransomware code
and the affiliates use that
code to deploy on the targets that they
breach on the networks they breach .
When the malware runs , when the
ransomware runs it encrypts the
contents of the drivers that can access .
And there's a note dropped that
indicates an email address that's
customized by the affiliate , telling
the victim to reach out and get a tool
that they use to identify , get the
identify their for their systems that
have been encrypted . Sometimes they'll
require a payment up front to get that .
Usually then the victim gets the tool
runs , it gets the I . D . Number and
sends it back , it's in a block of text
that sends it back to the affiliate who
then takes it to a portal run by
Dharma as developers where they enter
the I . D . And get a key
generator that will produce the keys
that they then deliver to the victim .
They have to pay for that . So this is
how the Dharma operators take their
piece out of every single attack . The
affiliate then may double down and ask
for more money in order to deliver the
decrypt er we've seen this happen a
number of times .
So the typical route for dharma
compromise uh begins with RDP
uh Sometimes they brute access and more
sophisticated actors in the affiliate
network may use brute access or may use
phishing attacks to steal credentials
but we also see them buying credentials
off the dark web . Uh They then use the
RDP access and the remote folder to
basically get access and drop
tools onto the target is needed . Many
of the tools are run remotely or are
scripted remotely and then execute
power Shell script and other content
over the RDP connection . And they're
all driven by this tool belt script
that will go into shortly . That is
used to automate the attack Playbook .
So essentially these affiliates can
basically run from a sort of
telemarketer script of how to do an
attack . They don't have to have deep
skills , they have a set of tools they
can use . Many of them are automated
and many of them are just a simple
mouse click to do things , do things
like password extraction and other
things required to exploit and then
they just follow a script to do what
they need to do to drop the ransomware
and then and then compromise and
further compromise the victim's network .
Okay , so this is the tool belt power
shell tool . Uh This is how it looks in
the power Shell command line
interface . It's a number driven menu
system and we've documented 76 menu
selections in it . Uh It does a number
of things . Obviously it goes through
and deploys ransomware as it's one of
its final steps or one of the one of
its options , but it also has a number
of sub scripts as the number of sub
power shell scripts that it can execute .
And it deploys commercial and freeware
tools in order to extract more
information or to smooth the path for
ransomware deployment . Uh And let's go
through a few of them . Okay ,
here's the kill chain for this tool set
using the miter attack framework
categories , and we'll go into some of
these tools specifically . But as you
can see a lot of the Power Shell and
uh native tools are used for
exploitation uh including RdP
internally . Uh and w my
also some remote
management when rM remote management is
used as well , and group policy objects
for distribution across the network .
Um but there are a whole bunch of
functions here taken care of by uh
commercial and freeware tools as well
as open source tools .
So these are the attack , there are a
whole bunch of different categories of
attack tools until the other as I just
mentioned . So we got uh we categorize
them into these sets . There's there
are past reviewers uh there are a
number of processing and killing
process killing tools , uh there are
tools for unlocking files and
uninstalling files , network crime
reconnaissance tools , there's also a
Windows registry editor in the set . Uh
and there are tools for taking data
from hash dumps and other sources and
exfiltrate ng it via the cloud or
through the command control bot that's
installed by the Attackers which uses a
tour based back door . And then there's
heavy use of native Windows tools um
such as uh the Windows install
windows installed and uninstalled
utility and Power shell obviously and
then also custom power shell tools
exploiting those native Windows tools
with w my Windows remote management .
Uh The uh as I said before
the the global policy objects are used
as well and there are other Windows
command line interfaces tools used .
So the past reviewers are dumped by a
menu selection from toolbox from tool
belt to generate to dump into
a local folder in the temp folder ,
temp folder in the targeted systems
drive you drive using the credentials
that they've logged into with RdP .
These include many cats which is a well
known password extraction tool , uh
Lasagne which is a password scraper for
browsers primarily and near soft
remote desktop pass you pass reviewer
tool which will go into briefly so many
cats . There are two versions of women
cats deployed by the tool by the tool
belt . The
this version uh menu selection four
uh is an automated does an automated
launch of the MCATs by power shell and
it does a quick dump to a note back doc
of user names and passwords that it
finds . There's a
second version which is a an auto I . T .
Execute Herbal and it combines
both democrats and nl brute . Another
known mel tool for doing password
extraction is brute force password
guessing and and then it dumps the user
names and passwords it finds Into two
separate text files . You can see here
in the interface for this tool that it
tells in Russian how many
uh user names it found and how many
passwords exploited . So this is all
automated . It's just a single click
from the menu and it dumps those things
out and those can then be cut and
pasted back to the attacker's system .
Next there's the near soft remote
desktop past few . This this is a
free utility and it goes into
RdP files that are stored on the local
machine to discover passwords and user
names that are stored in . Um It only
works with older RdP implementations
and but there's another newer version ,
a new network password recovery tool
that can handle a wider range of these
types of passwords from newer systems
as well as getting file share passwords
and things like that . This tool is
detected as a potentially unwanted
application by anti viruses or malware
on by many anti viruses . So uh
one of the things that the Attackers
will do before using this is turn to
evasion tools to kill anti viruses .
One of those is Jimmer . Uh This is an
open source tool not free freeware tool ,
pardon me that finds hidden processes ,
threads and things that lock onto files
that would prevent them from being uh
removed or encrypted , including sequel ,
server connections and things like that .
So you can use this tool to hunt
through and find all of the file locks
uh that are existing as well as hidden
processes like uh malware protection
and and kill them . And
a similar tool that is in the same
package is the same , same package of
tools on tool belt is process hacker .
This is a GPL tool that allows you to
do a dive down into processes that are
locking files and you can show which
processes have network connections .
Close those network connections , you
can perform stack traces and you can
even edit and control services as well .
So one of the things that is automated
on tool belt is the is doing a dump of
hash of hashes of passwords in ,
pardon me , while I remove my cat ,
the joys of doing this remote and
recorded in any case uh
The hash sweet tools
does a dump can perform a dump of of
password hashes . And then the tool
opens up a link to drop me files dot
com and web browser so that the
attacker can drag the hash files
into a cloud service for exfiltration
over a secure web connection . So over
TLS they can exfiltrate the hash files
and then remotely work on them to
discover more pathways . These attacks
generally last for a prolonged period .
Their dharma attacks are not as
fast as some of the others we've seen
from more professional rings . So uh an
average time on the network may be
several days before they launched the
ransomware and this is one of the
reasons why they drag stuff up . They
try to manually extend their
exploitation of the network by doing
this sort of password extraction and
when they're done they then launch the
grant somewhere . So
there's another tool here for
reconnaissance . That's another ,
another freeware tool that's commonly
used by network administrators as well
as by ransomware operators called
advanced I P scanner . This is used to
discover additional systems that can be
accessed on the network . It can find
network folders and find other
computers and then use remote admin ,
remote control and RDP to take control
of those systems to manipulate those
systems . And you can even execute
remote shutdowns of other systems . Um
This can be used by the attacker to do
some lateral movement by
connecting , driving the RDP client on
the RdP target and moving further and
further in the network as well as
gaining access to files on remote
systems and dropping ransomware in that
way
this is the this is the command and
control bot . It's called zombie
fication . It's a menu , a menu
selection from the tool belt . It'll by
clicking OK it runs an I not a Y T
process that obtains the external
address of the system . the external ip
addressing system to ensure that it is
actually connected to the internet and
then it downloads and installs a tour
network client . Uh and that
then test the torrent client to make
sure that it's operational and that
collects all the information on your
account data and another recon data and
exfiltrate , sit over toward to a
remote dot onion server . Then it goes
into sleep mode and it waits for timer
events . So this maintains persistence
on the machine after the attacker has
logged out of authority . P
So this is a sample of what we've seen
with a couple of these dharma attacks
when the intruders when the Attackers
get into the network , they initially
launched tool belt script . Then they
run a custom power shell script called
delete a V services that ps one which
goes and looks for a list of antivirus
services and disables .
They then run Jimmer to see if they
missed anything and to look for hidden
processes . They need to shut down to
gain access to files . These process
hacker as well to basically do the same
thing . Then they moved me cats and
then ill brute collect passwords . Use
advanced ip scanner to find other
systems . They then use remote desktop
client connection to move laterally in
the network from their initial landing
point and continue the process and they
go through the same list of things on
each target they identify and connect
it over . Rdp . Then they run takeaway
dot E X E , which is the ransom work
packer . When it drops it installs
ransomware . Um and then
they run another network executed a
network scanner that looks for a
mounted volumes on the same system to
enable to re mount them in order for
the system to be able to encrypt them .
And we've got a full report on all of
the menu selections we documented and
the IOC is online that when we
published back in august along with
newer IOC's that are updated on
our on our guitar page linked
from this report
with that , I'm gonna go to questions
uh meet you in the
discord and if you've got any further
questions about any of this , feel free
to ping me by email or by twitter if
you don't get a chance to get the
discord , you're watching this recorded
later on . Obviously watching recorded
because I'm not physically there . So
I'm ready to take your questions and
I'll meet you in the discord . Thanks
again everyone . And I hope to see you
in Meatspace next year