Unleashing the Kraken ransomware group

MITRE Techniques

• [T1210] Exploitation of Remote Services – Kraken exploited SMB vulnerabilities on internet-exposed servers for initial access (“the Kraken actor gained initial access to the victim’s machine by exploiting an existing vulnerability in the SMB service on servers exposed to the internet”).
• [T1078] Valid Accounts – The actor extracted valid administrator and privileged account credentials and re-entered via Remote Desktop using those credentials (“they extracted valid administrators’ and other privileged accounts’ credentials… re-entered the victim environment through a Remote Desktop connection using the exfiltrated privileged account credentials”).
• [T1098] Account Manipulation (persistence via external service) – Established persistent access by installing Cloudflared and configuring a reverse tunnel on the victim machine (“installed the Cloudflared tool and configuring a reverse tunnel on the victim’s machine”).
• [T1048] Exfiltration Over Alternative Protocol – Used SSHFS to navigate the environment and exfiltrate sensitive data (“installed the SSHFS tool on the victim machine, utilizing it to navigate the victim’s environment and exfiltrate sensitive data”).
• [T1486] Data Encrypted for Impact – Deployed Kraken encryptors across Windows, Linux, and ESXi to encrypt files and append .zpsc, with ransom notes (“Kraken encrypts the victim’s environment, uses the .zpsc file extension for the encrypted files, and drops a ransom note titled ‘readme_you_ws_hacked.txt’”).
• [T1112] Modify Registry (to find SQL data paths) – The SQL encryption module queries SQL Server registry keys to locate database file paths (“the module accesses the Microsoft SQL Server registry keys… retrieving the ‘SQLDataRoot’ registry value to determine the path to the database files”).
• [T1490] Inhibit System Recovery – The ransomware stops backup services and deletes restore points (“stops the backup services, and executes the embedded command to remove all restore points… vssadmin delete shadows /all /quite”).
• [T1140] Deobfuscate/Decode Files or Information (anti-analysis/obfuscation) – Kraken employs control-flow obfuscation and other anti-analysis techniques to hinder detection and analysis (“employs extensive control flow obfuscation with multiple conditional loops throughout the code”).
• [T1070] Indicator Removal on Host – Performs multi-stage self-deletion and cleanup to remove logs, history, and binaries (“creates a bash script ‘_bye_bye_.sh’ … delete the log files, shell history, ransomware binary, and the script itself”).
• [T1499] Endpoint Denial of Service (stopping VMs) – For ESXi and Hyper-V, the ransomware force-stops VMs to unlock files for encryption (“forcefully stops all running virtual machines” / “esxcli vm process kill –type=force –world-id=”).