Threat actors in the DB#JAMMER campaigns compromised exposed MSSQL databases via brute-force login attempts and deployed a full toolkit leading to ransomware and Cobalt Strike payloads. The operation progressed from initial access through enumeration, defense evasion, persistence, lateral movement, credential dumping, and culminating in FreeWorld ransomware deployment with extensive C2 and tool-usage infrastructure. #DBJAMMER #FreeWorld #MimicRansomware #MSSQL #xp_cmdshell #CobaltStrike #Ngrok #AnyDesk
Keypoints
- Threat actors targeted exposed MSSQL services using brute force to gain initial access.
- After authentication, they rapidly enumerated the system and looked for credentials using queries like SELECT name FROM sys.sql_logins WHERE name IS NOT NULL.
- xp_cmdshell was leveraged to run shell commands from SQL Server, enabling immediate system enumeration and defense impairment.
- System and registry changes were performed to impair defenses, including registry edits and user/group modifications to strengthen persistence and RDP access.
- Persistence was established via remote SMB shares, then Cobalt Strike payloads (svr.exe) and Ngrok attempts were used for remote access; AnyDesk was later deployed for RAT-like control.
- Mimikatz was used to dump credentials, with a WDIGEST downgrade step to extract plaintext credentials.
- FreeWorld ransomware (a Mimic variant) was dropped and deployed, encrypting files with a .FreeWorldEncryption extension and providing a ransom note.
MITRE Techniques
- [T1110] Brute Force – Gained access to the victim host by brute forcing an MSSQL login. Quote: “The threat actors gained access to the victim host by brute forcing an MSSQL login.”
- [T1046] Network Service Discovery – Enumeration used wmic.exe, net.exe and ipconfig.exe to map the environment. Quote: “Enumeration was carried out using a few basic commands. Most of these included wmic.exe, net.exe and ipconfig.exe.”
- [T1112] Modify Registry – Registry changes were used to impair defenses and enable persistence. Quote: “The attackers enumerated the current state of the RDP environment by making the following registry changes to ensure connection success:”
- [T1562.001] Impair Defenses: Disable or Modify Tools – Registry and configuration changes were used to disable protections and facilitate access. Quote: “To avoid detection, the following command was executed… This registry modification prevents the last user who authenticated with the system to appear in the login screen.”
- [T1098] Account Manipulation – Creation of new user accounts and adding them to remote desktop/administrators groups. Quote: “Three new users were created on the victim host … Each user was added to the ‘remote desktop users’, ‘administrators’.”
- [T1505.001] Server Software Component: SQL Stored Procedures – Abuse of SQL Server components to maintain persistence. Quote: “T1505.001: Server Software Component: SQL Stored Procedures”
- [T1003] OS Credential Dumping – Mimikatz was used to dump credentials. Quote: “The batch file then executed mimikatz.exe to dump credentials.”
- [T1021.001] Remote Services: Remote Desktop Protocol – RDP was used for network access and persistence. Quote: “The attackers preferred using RDP to connect to the victim machine.”
- [T1105] Ingress Tool Transfer – Files/tools were transferred via a remote SMB share. Quote: “The network share allowed the attacker to transfer files to and from the victim system as well as install malicious tools.”
- [T1219] Remote Access Software – AnyDesk was used as a RAT-like remote access tool. Quote: “AnyDesk is a legitimate service that functions like a RAT.”
- [T1572] Encrypted Channel: Symmetric Cryptography – C2 communications implied by the C2 infrastructure configuration (Gelsd) and tool usage. Quote: “svr.exe appears to be a Cobalt Strike command and control payload. We observed it making DNS connections to gelsd[.]com.”
- [T1486] Data Encrypted for Impact – FreeWorld ransomware encryption of files. Quote: “The ransomware began encrypting the victim host and generated encrypted files using the ‘.FreeWorldEncryption’ extension.”
Indicators of Compromise
- [IP] 45.148.122.63 – Remote SMB server used for tool transfer and persistence. Context: remote SMB server used during network share operations.
- [Domain] gelsd[.]com – C2 address for svr.exe communications. Context: C2 from svr.exe.
- [File Hash] svr.exe – 8937A510446ED36717BB8180E5E4665C0C5D5BC160046A31B28417C86FB1BA0F
- [File Hash] 5000.exe – 80BF2731A81C113432F061B397D70CAC72D907C39102513ABE0F2BAE079373E4
- [File Hash] FreeWorld.exe – 75975B0C890F804DAB19F68D7072F8C04C5FE5162D2A4199448FC0E1AD03690B
- [File Hash] svr.exe (note) – 8937A510446ED36717BB8180E5E4665C0C5D5BC160046A31B28417C86FB1BA0F
- [File Name] Everything.exe – 4C83E46A29106AFBAF5279029D102B489D958781764289B61AB5B618A4307405
- [Domain/File] gelsd.dll – 11259F77F4E477CD066008FBFC7C31D5BBDC9EF708C4B255791EE380999A725C
- [File] 7zipsfx.0007za.exe – used to decrypt Everything64.dll during ransomware drop