Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

5/13/2019
05:25 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

LockerGoga, MegaCortex Ransomware Share Unlikely Traits

New form of ransomware MegaCortex shares commonalities with LockerGoga, enterprise malware recently seen in major cyberattacks.

MegaCortex, a newly discovered form of ransomware that targets global organizations, was found to share similarities with LockerGoga, a known form of malware seen in enterprise attacks.

Sophos researchers published initial findings related to MegaCortex late last week. The active ransomware variant sends victims a note designed to read as if it's from Morpheus, Laurence Fishburne's character in The Matrix. MegaCortex was spotted hitting several enterprise customers across the US, Europe, and Canada, with 47 attack attempts within a 48-hour period.

A few traits of MegaCortex made the campaign stand out. Victims reported the attacks originated from a compromised domain controller, and adversaries used stolen admin credentials to run a PowerShell script using the compromised controller — both traits that make it unique, says Jessica Bair, senior manager of advanced threat solutions at Cisco Systems.

Researchers note this ransomware is mostly seen among businesses with existing Emotet and Qbot infections, both of which can be used as launching points to distribute other malware. Given this, organizations previously exposed to either threat should prioritize remediation.

In the week since its early findings were disclosed, the Sophos team has become aware of more attacks involving MegaCortex and updated their research to reflect additional data on the tools, techniques, and other specifics that were not known at the time of publication.

"Since last week we have learned a lot more of the small details about the behavior and tooling used by MegaCortex," says Chet Wisniewski, Sophos' principal research scientist. "Many of these details are similar or identical to another ransomware named LockerGoga," however, there isn't much code similarity between them. Still, there are a few interesting similarities:

Links to LockerGoga
LockerGoga is a form of ransomware recently used in a major cyberattack against Norwegian aluminum firm Norsk Hydro, where it disrupted critical operations across North America and Europe. The incident forced Norsk Hydro to transition to manual operations at multiple plants; so far, it has cost the manufacturer $40 million. Once on a system, LockerGoga, which appears to be designed for targeted campaigns, changes passwords and forcibly logs victims out of systems.

The two forms of ransomware appear to behave the same way, Wisniewski explains. In both, operators leverage a compromised domain controller to push malware out to machines on a target network. From there, they open a reverse shell from the internal network to one of their command-and-control (C2) servers to execute the attacks. At least one of the C2 addresses that MegaCortex contacts has also been used by LockerGoga, researchers explain in a blog post.

MegaCortex also renames the files it plans to encrypt before encrypting them, which is unusual for ransomware — except LockerGoga, which does the same. "We suspect this may be used to prevent the malware from unintentionally encrypting files twice on an infected machine," says Wisniewski. The tactic has another effect: it makes those renamed files "un-double-clickable" as it removes the file type association of the document with its parent application.

One of the most obvious similarities is the batch file used in the attack, Wisniewski continues. Many researchers think it's "virtually identical" to batch files used to kill processes during LockerGoga attacks. Still, he says, none of the individual similarities are enough to make any attribution to MegaCortex's origin. At this time, they remain a "large number of interesting coincidences."

Contemplating Cryptographic Certificates
MegaCortex uses signed binaries with the common name (CN) mimicking the same CN used in the signed binaries of completely unrelated malware families. For example, researchers queried a CN on the cryptographic certificate used to sign one of the MegaCortex malware executables. They found malware from Rietspoof, a financial-services credential stealer with no code similarity or link to MegaCortex.

"We're not sure why they would do this," says Wisniewski. "Often things are thrown in to confuse those investigating the attacks, a sort of 'false flag operation.'" The certificates for MegaCortex were issued by different authorities from the certificates they were mimicking; for example, that of Rietspoof. Some certificate authorities are now revoking the certificates used in MegaCortex attacks, Wisniewski says.

Investigation into certificates yielded another interesting finding: researchers noticed the address used by the certificate — a street address located in London suburb Romford — is connected to more than 74,000 registered UK businesses. There is also evidence the same address has been used in signing certificates that were then used to sign unrelated malware binaries. They're still looking into this.

"We do not really understand how an apparent residential address ended up being used as a business address for some 74,000+ companies currently or formerly registered in the UK," says Wisniewski, who adds that site for The Companies House — the United Kingdom's registrar for companies — permits visitors to access only the first 1,000 records of this search.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
GDPR Enforcement Loosens Amid Pandemic
Seth Rosenblatt, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11018
PUBLISHED: 2020-05-29
In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0.
CVE-2020-13634
PUBLISHED: 2020-05-29
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xF1002558
CVE-2020-12675
PUBLISHED: 2020-05-29
The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-202...
CVE-2020-11017
PUBLISHED: 2020-05-29
In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixed in version 2.1.0.
CVE-2020-4306
PUBLISHED: 2020-05-29
IBM Planning Analytics Local 2.0.0 through 2.0.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 17...