GOLD SALEM tradecraft for deploying Warlock ransomware

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – SharePoint vulnerabilities and the ToolShell zero-day chain were exploited for initial access (‘exploited SharePoint vulnerabilities’ / ‘chained exploitation of zero-day vulnerabilities (ToolShell)’).
• [T1105 ] Ingress Tool Transfer – Tools and installers were downloaded into victim environments from attacker-controlled workers[.]dev domains and Azure blob storage (‘downloaded from a host in the qaubctgg[.]workers[.]dev domain’ / ‘hxxps://…blob[.]core[.]windows[.]net/veeam/v2.msi’).
• [T1059.001 ] PowerShell – Encoded PowerShell commands were used to download and execute installers prior to installing Velociraptor as a service (‘downloading the file from the same workers[.]dev domain using an encoded PowerShell command’).
• [T1543.003 ] Create or Modify System Process: Windows Service – Velociraptor was installed and configured to run as a service on compromised hosts (‘installing it as a service’).
• [T1136.001 ] Create Account: Local Account – Attackers created local administrator accounts for persistence using net commands (‘net user backupadmin abcd1234’).
• [T1003.001 ] OS Credential Dumping: LSASS Memory – The actors enumerated LSASS and used MiniDump via Comsvcs.dll to obtain credentials from memory (‘identify the LSASS process number…obtain the hashed credentials via the MiniDump function of the native Comsvcs.dll’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – vmtools.exe and vulnerable drivers (rsndspot.sys, kl.sys, ServiceMouse.sys) were used to disable AV/EDR solutions in BYOVD-style attacks (‘use an antivirus (AV) and endpoint detection and response (EDR) agent killer named vmtools.exe’ / ‘imported and used two drivers (rsndspot.sys and kl.sys)…in a BYOVD attack’).
• [T1574.001 ] Hijack Execution Flow: DLL Side-Loading – Possible DLL side-loading was observed against Java processes using the legitimate Java Launcher Interface jli.dll (‘possible DLL side-loading of Java processes via the legitimate Java Launcher Interface file (jli.dll)’).
• [T1090 ] Proxy and Tunneling (C2) – VS Code tunnel mode and the Cloudflared tunneling tool were used to establish C2 and remote tunnels into victim environments (‘execute Visual Studio Code (VS Code) (code.exe) with the tunnel option enabled’ / ‘Cloudflared tunneling tool downloaded’).
• [T1486 ] Data Encrypted for Impact – Ransomware families (Warlock, LockBit, Babuk) were used to encrypt files and append extensions such as .x2anylock/.xlockxlock as part of impact and extortion (‘Warlock typically adds the .x2anylock extension to encrypted files’).