Threat actors use hacked domain control to host malicious content by leveraging legitimate domains to evade detection by security measures.
Anti-AV tactics are employed to bypass the antivirus software and tools that enable the execution of malicious code without detection.
Together all these tactics enhance the stealth and effectiveness of cyber attacks that allow threat actors to compromise systems and steal sensitive information with greater ease.
Recently cybersecurity researchers at Trend Micro discovered that RA World (previously the RA Group) ransomware has been attacking Windows using hacked domains and Anti-AV tactics.
Technical Analysis
The RA World ransomware which was once known as the RA Group broke into global organizations since April 2023.
Researchers identified that this ransomware group mainly targeted US firms, but besides the US firms it also struck in:-
- Germany
- India
- Taiwan
This ransomware group mainly targets healthcare, insurance, and financial businesses. RA World operators’ breach through compromised domain controllers allowed dropping the components in SYSVOL for GPO.
While the deployment of Stage1.exe via PowerShell indicated at altered Group Policy settings enabling script execution. The malware may have infiltrated Group Policy, allowing it to run on multiple machines within the domain.
Attack chain (Source – Trend Micro)
Here Stage1.exe scans for the domain controllers by halting if conditions are met, like the matching host names. It also checks for Finish.exe and Exclude.exe in %WINDIR%\Help, which indicates the past compromise or exclusion.
Stage1.exe (Source – Trend Micro)
Ransomware checks for Stage2.exe in %WINDIR%\Help. If absent then it copies pay.txt and Stage2.exe from a hardcoded SYSVOL Path which indicates a targeted attack with a company domain name.
This strategy involves initial payload presence on one machine, then execution on others via Group Policies which helps in revealing a multi-stage approach to compromise the network targeted.
T1543.003 – The program checks for safe mode, then creates MSOfficeRunOncelsls service with Stage2.exe, configuring it for Safe Mode with Networking.
T1562.009 – It configures BCD for Safe Mode, starts the machine. If already in Safe Mode, Stage2.exe decrypts pay.txt to Stage3.exe, the ransomware payload.
T1070.004 – After execution, cleanup deletes remnants, and creates registry keys.
In stage 3 the RA World ransomware (Stage3.exe) deploys and drops the Finish.exe which creates the mutex. The ransom note includes a list of recent victims of extortion tactics.
Ransom note (Source – Trend Micro)
T1485 – RA World deploys SD.bat to wipe the Trend Micro folder by using WMIC for disk info and leaving a log. Besides this, T1070 – After deletion, the ransomware removes Safe Mode with the Networking option. T1529 – It forcibly reboots the computer.
Babuk ‘retired’ in 2021, but leaked source code fuels new threats like RA World. This, combined with Ransomware-as-a-Service, lowers the entry barrier for less skilled cybercriminals.
Recommendations
Here below we have mentioned all the recommendations:-
- Limit administrative rights to employees.
- Keep security products updated.
- Back up essential data routinely.
- Exercise caution with emails, attachments, URLs, and program execution.
- Encourage users to report suspicious emails and files promptly.
- Regularly educate users on social engineering risks.