Toy Ghouls’ new toy: the GenieLocker ransomware

MITRE Techniques

• [T1133] External Remote Services – Initial access was achieved through an OpenVPN connection from an external partner network (‘the attackers first entered the environment through an OpenVPN connection originating from an external partner’s network’).
• [T1078] Valid Accounts – The attackers likely used stolen but still valid credentials to access the target (‘used stolen, yet still valid, credentials to connect’).
• [T1046] Network Service Scanning – SoftPerfect Network Scanner was used for discovery (‘They employed SoftPerfect Network Scanner for discovery’).
• [T1003] OS Credential Dumping – Mimikatz was used to dump credentials (‘used Mimikatz to dump credentials’).
• [T1110] Brute Force – Not explicitly described as brute force; skip.
• [T1219] Remote Access Software – OpenSSH and socks5.exe were installed on compromised hosts as additional remote access tooling (‘installed additional tools… including OpenSSH, socks5.exe’).
• [T1021.001] Remote Services: Remote Desktop Protocol – Lateral movement to Windows machines was done with RDP (‘Lateral movement was performed by using RDP to reach Windows machines’).
• [T1021.004] Remote Services: SSH – Lateral movement to Linux servers was done with SSH (‘and SSH for Linux servers’).
• [T1569.002] Service Execution – PsExec and PAExec were used to deploy the ransomware broadly (‘widespread deployment … with the legitimate utilities PsExec and PAExec’).
• [T1090.001] Proxy: Internal Proxy – The attackers established a reverse SSH tunnel for C2 communication (‘established a reverse SSH tunnel to communicate with their command-and-control server’).
• [T1486] Data Encrypted for Impact – Files and VM disks were encrypted on Windows, Linux, and ESXi systems (‘encrypted files on the compromised Windows machines’ and ‘encrypted their disks’).
• [T1529] System Shutdown / Reboot – Active virtual machines were stopped before disk encryption (‘they stopped active virtual machines’).
• [T1562.001] Impair Defenses: Disable or Modify Tools – The malware terminates processes and stops services that might block encryption (‘starts to kill processes’ and ‘stops the following services’).
• [T1105] Ingress Tool Transfer – Additional tools such as OpenSSH, socks5.exe, SoftPerfect Network Scanner, and Mimikatz were placed on hosts after intrusion (‘installed additional tools on the compromised hosts’).
• [T1027] Obfuscated Files or Information – The secret hex argument and hashing checks may be intended to hinder sandboxing and analysis (‘the purpose of this is to avoid execution on sandboxes and other automated analysis environments’).
• [T1057] Process Discovery – Process names and targeted applications were enumerated for termination (‘kills processes that could be using the files of interest’).
• [T1497.001] Virtualization/Sandbox Evasion: System Checks – Environment and debugger checks were used to detect analysis environments (‘Environment check’ and ‘detect the debugger’).