Trend Micro details Water Bakunawa’s RansomHub ransomware, which uses advanced anti-EDR techniques, including the EDRKillShifter loader, to evade detection and disrupt security. The report maps RansomHub’s infection chain, MITRE techniques, and Armor against multi-sector targets, and provides defensive recommendations. #WaterBakunawa #RansomHub
Keypoints
- Water Bakunawa is the threat group behind the RansomHub ransomware.
- RansomHub employs anti-EDR techniques, notably the EDRKillShifter tool, to disrupt defenses.
- Exploits Zerologon (CVE-2020-1472) to gain network access.
- Targets multiple sectors, including healthcare, IT, government services, and more.
- Spear-phishing is used for targeted initial access.
- EDRKillShifter: a BYOVD-style loader that disables security tools and elevates privileges.
- RansomHub exfiltrates data via rclone and threatens public release if unpaid; AnyDesk is used for C2.
- Vision One telemetry helps map TTPs and inform security recommendations.
MITRE Techniques
- [T1078.002] Valid Accounts: Domain Accounts – Used for gaining initial access through legitimate credentials. “a single compromised user account was primarily responsible for most malicious activities, indicating that it was the principal entry point”.
- [T1210] Exploitation of Remote Services – Exploits vulnerabilities in remote services for access. “Zerologon vulnerability (CVE-2020-1472)”.
- [T1569.002] Service Execution – Executes services to run malicious payloads. “Executes services to run malicious payloads.”.
- [T1548.002] Abuse Elevation Control Mechanism: Bypass User Account Control – Bypasses UAC to gain elevated privileges. “Bypasses UAC to gain elevated privileges.”.
- [T1562.001] Impair Defenses: Disable or Modify Tools – Disables security tools to evade detection. “Disables security tools to evade detection.”.
- [T1222.001] Windows File and Directory Permissions Modification – Modifies permissions to access sensitive files. “Modifies permissions to access sensitive files.”.
- [T1070.001] Clear Windows Event Logs – Erases logs to cover tracks of malicious activities. “Erases logs to cover tracks of malicious activities.”.
- [T1562.009] Safe Mode Boot – Boots in safe mode to avoid detection by security tools. “Boots in safe mode to avoid detection by security tools.”.
- [T1110] Brute Force – Employs brute force techniques to gain access. “Employs brute force techniques to gain access.”.
- [T1003.001] OS Credential Dumping: LSASS Memory – Extracts credentials from LSASS memory. “Extracts credentials from LSASS memory.”.
- [T1567.002] Exfiltration to Cloud Storage – Transfers stolen data to cloud storage for exfiltration. “Transfers stolen data to cloud storage for exfiltration.”.
- [T1046] Network Service Discovery – Maps out network services for lateral movement. “Maps out network services for lateral movement.”.
- [T1021.002] Remote Services: SMB/Windows Admin Shares – Uses SMB shares for lateral movement within the network. “Uses SMB shares for lateral movement within the network.”.
- [T1486] Data Encrypted for Impact – Encrypts files to extort victims. “Encrypts files to extort victims.”.
- [T1490] Inhibit System Recovery – Deletes backups to prevent recovery. “Deletes backups to prevent recovery from ransomware.”.
- [T1041] Exfiltration Over C2 Channel – Exfiltration over C2 channel. “Exfiltration over C2 Channel” is cited as the tactic.
Indicators of Compromise
- [File Name] – Evading and disabling defenses via batch scripts: 232.bat, tdsskiller.bat, killdeff.bat, LogDel.bat
- [Registry] – Registry modifications to enable remote access: HKEY_CURRENT_USERSoftwareMicrosoftTerminal Server ClientServers, HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon
- [File Name] – Loader and ransom artifacts: data.bin, README_1d7fdb.txt
- [File Name] – RDP attribute tampering: Default.rdp
- [Process/Executable] – Credential dumping artifacts: Taskmgr.exe, lsass.DMP
- [Service] – New service created: KB20240815 (EDRKillShifter driver interaction)
- [Executable] – C2 and tooling: AnyDesk.exe used for remote control
- [Executable] – Shadow copy deletion utility: vssadmin.exe (deleting VSS snapshots)