RansomHub affiliate uses Python backdoor to compromise networks

Description

 

An attack has been detected in which a malicious actor used a Python-based backdoor to maintain persistent access to compromised systems and subsequently deploy the RansomHub ransomware across the affected network.

 

 

Technical Details

 

Initial access was gained via a JavaScript malware known as SocGholish, which is distributed via campaigns that trick users into installing fake web browser updates. These campaigns often involve legitimate but infected websites, to which victims are redirected from search engine results manipulated with SEO techniques.

 

Once executed, SocGholish communicates with a server controlled by the attacker to download additional malicious payloads. Subsequently, the Python backdoor is installed approximately 20 minutes after the initial SocGholish infection and then the backdoor propagates to other machines on the same network via RDP sessions. The Python script acts as a reverse proxy that connects to a predefined IP address.

 

After establishing a connection to the C2 server, it creates a tunnel based on the SOCKS5 protocol, allowing the attacker to move laterally through the compromised network using the victim's system as a proxy.

 

This backdoor has been active since December 2023, featuring superficial changes aimed at improving its obfuscation methods to evade detection. The script code is polished and well-structured, suggesting that the malware author is meticulous in maintaining readable and testable Python code, or uses artificial intelligence tools to assist in programming.

 

In addition to the Python backdoor, other tools used prior to ransomware deployment have been identified, such as EDRSilencer and Backstab to disable detection and response solutions on endpoints, LaZagne for credential theft, MailBruter for forcing email credentials, and Sirefef and Mediyes to maintain access and deliver additional payloads.

 

Techniques used

 

INITIAL ACCESS

Drive-by Compromise - T1189

Spearphishing Link - T1566.002

 

EXECUTION

Command and Scripting Interpreter: Python - T1059.006

User Execution: Malicious File - T1204.001

 

DEFENSE EVASION

Impair Defenses: Disable or Modify Tools - T1562.001

Obfuscated Files or Information - T1027

 

COMMAND & CONTROL

Proxy: Multi-hop Proxy - T1090.003

 

DISCOVERY

Remote System Discovery - T1018

System Information Discovery - T1082

 

IMPACT

Data Encrypted for Impact - T1486

Inhibit System Recovery - T1490

Recommendations