This article details a targeted ransomware attack by the 3AM group using sophisticated social engineering via email bombing and Microsoft Teams vishing to gain remote access. The attackers deployed a QEMU-based backdoor, evaded endpoint protections, stole data, and attempted but largely failed to encrypt systems due to strong defenses like multifactor authentication and Sophos XDR. #3AMRansomware #Vishing #QEMUBackdoor #SophosXDR #MultifactorAuthentication
Keypoints
- The 3AM ransomware group conducted extensive reconnaissance to tailor a multi-stage attack involving email bombing and voice phishing (vishing) over Microsoft Teams, spoofing the internal IT department phone number.
- Attackers exploited Microsoft Quick Assist to gain remote control and deployed a virtual machine (QEMU) containing the QDoor trojan for covert network access, evading endpoint protection detection.
- They compromised domain services and administrator accounts, performing lateral movement across nine hosts using PowerShell, WMIC, and remote desktop protocol (RDP).
- Multifactor authentication (MFA) successfully blocked many lateral movement attempts, though attackers tried unsuccessfully to uninstall MFA and disable Sophos endpoint protection.
- Data exfiltration of approximately 868 GB was executed via a legitimate cloud sync tool (GoodSync) to Backblaze storage before the ransomware deployment attempt.
- The ransomware deployment was limited primarily to an unmanaged device without endpoint protection; Sophos CryptoGuard prevented encryption on protected systems.
- Recommendations include building employee awareness of vishing tactics, auditing admin accounts, enforcing application control policies, implementing MFA, and restricting remote access and registry modifications.
MITRE Techniques
- [T1566.002] Phishing: Spearphishing Link – Attackers conducted “email bombing” with multiple unsolicited emails to overwhelm the target, facilitating social engineering (‘Employee received 24 unsolicited emails within a 3-minute period’).
- [T1204.002] User Execution: Malicious File – The victim was tricked into allowing remote access via Microsoft Quick Assist during a phone call spoofing the IT department (‘Using the emails as a pretext, the threat actor socially-engineered the employee to grant them remote access’).
- [T1610] Deploy Container – Attackers deployed a QEMU virtual machine on the compromised host to isolate malicious activity and connect to the network (‘launched a Windows 7 virtual machine within the Qemu emulator’).
- [T1105] Ingress Tool Transfer – Used a spoofed domain to download malware payloads from Google Drive and a one-time SMS service (‘navigated to msquick[.]link which redirected to 1ty[.]me… containing UpdatePackage_excic.zip’).
- [T1021.002] Remote Services: SMB/Windows Admin Shares – The ransomware batch file attempted to map C$ shares across 88 hosts to propagate (‘start 1l L.exe … -p [host IP address]c$’).
- [T1078] Valid Accounts – Attackers created and used local administrator accounts for persistence and lateral movement (‘created local administrator account [SupportUser] and used Remote Desktop to access servers’).
- [T1106] Native API – Used WMIC and PowerShell commands to execute payloads and perform discovery across systems (‘wmic product where “name=Duo Authentication” call uninstall’, ‘PowerShell commands for discovery and lateral movement’).
- [T1041] Exfiltration Over C2 Channel – Data exfiltrated via GoodSync to a cloud provider Backblaze (‘uploaded approximately 868 GB of data to Backblaze’).
- [T1005] Data from Local System – Large data collection prior to exfiltration documented (‘stole data from the targeted organization’s network’).
Indicators of Compromise
- [Domain ] Spoofed phishing domains used for payload delivery – msquick[.]link, 1ty[.]me
- [File Hashes ] Malicious QDoor backdoor samples – vol.exe, svchost.exe (disguised copies of QDoor malware)
- [IP Address ] Command and control server associated with QDoor trojan – 88.118.167[.]239:443 (Lithuania ISP)
- [File Names ] Ransomware and related payloads – UpdatePackageexcic.zip, Update.vbs, UpdatePackageexic, L.exe, 1.bat
- [Remote Access Tools ] Legitimate and malicious tools used – Microsoft Quick Assist, XEOXRemote, Syncro Live Agent (Synchro XMM)