#StopRansomware: Phobos Ransomware | CISA

MITRE Techniques

• [T1598] Phishing for Information – Used to obtain credentials or delivery vectors via email campaigns (‘Phobos actors typically gain initial access to vulnerable networks by leveraging phishing campaigns’).
• [T1595.001] Scanning IP Blocks – Actors scan IP ranges to find exposed RDP ports using tools like Angry IP Scanner (‘IP scanning tools, such as Angry IP Scanner, to search for vulnerable Remote Desktop Protocol (RDP) ports’).
• [T1110] Brute Force – Open-source brute force tools target RDP to gain valid account access (‘the actors use open source brute force tools to gain access’).
• [T1078] Valid Accounts – Compromised RDP credentials are used to authenticate and move within the environment (‘If Phobos actors gain successful RDP authentication … they perform open source research to create a victim profile’).
• [T1133] External Remote Services – RDP and other external services are leveraged for initial access and persistence (‘actors may leverage external-facing remote services to initially access and/or persist’).
• [T1566.001] Phishing: Spearphishing Attachment – Spearphishing attachments deliver hidden payloads that execute user-initiated malicious files (‘threat actors send spoofed email attachments … embedded with hidden payloads’).
• [T1204.002] User Execution: Malicious File – Malicious attachments or embedded payloads rely on user execution to install loaders like SmokeLoader (’embedded with hidden payloads such as SmokeLoader’).
• [T1059.003] Windows Command Shell – cmd.exe and custom executables are used to run system commands for deployment and system modification (‘Phobos actors run executables like 1saas.exe or cmd.exe to deploy additional Phobos payloads’).
• [T1055.002] Process Injection: Portable Executable Injection – SmokeLoader injects code into running processes using VirtualAlloc/VirtualProtect to establish execution entry points (‘Smokeloader manipulates either VirtualAlloc or VirtualProtect API functions—which opens an entry point’).
• [T1055.004] Process Injection: Asynchronous Procedure Call – Shellcode uses APC-style calls into memory containers during Smokeloader’s staging (‘the shellcode also sends a call from the entry point to a memory container’).
• [T1105] Ingress Tool Transfer – Final payloads and tools are transferred into the environment from external locations or unpacked from memory/hash stores (‘Phobos ransomware extracts its final payload from the hashed file’).
• [T1219] Remote Access Software – Remote access tools are deployed to maintain control of compromised systems (‘deployed remote access tools to establish a remote connection within the compromised network’).
• [T1562.004] Disable or Modify System Firewall – Actors modify firewall settings to bypass defenses (‘netsh firewall set opmode mode=disable’).
• [T1547.001] Registry Run Keys / Startup Folder – Persistence via Run keys and Startup folders is used to relaunch malware on boot (‘Phobos has also been observed using Windows Startup folders and Run Registry Keys’).
• [T1134.001] Access Token Manipulation: Token Impersonation/Theft – Windows API functions are used to steal tokens and impersonate users for privilege escalation (‘use built-in Windows API functions to steal tokens’).
• [T1003.005] OS Credential Dumping: Cached Domain Credentials – Cached hashes are used to authenticate up to domain admin if domain controllers are unavailable (‘attempt to authenticate using cached password hashes on victim machines’).
• [T1003.001] OS Credential Dumping: LSASS Memory – Tools like Mimikatz are used to dump credentials from LSASS memory (‘used Mimikatz to export credentials’).
• [T1555.003] Credentials from Web Browsers – NirSoft and Remote Desktop Passview are used to extract browser-stored credentials (‘NirSoft, as well as Remote Desktop Passview to export browser client credentials’).
• [T1071.002] Application Layer Protocol: File Transfer Protocols – WinSCP is used to upload exfiltrated data to actor-controlled FTP servers (‘use WinSCP to connect directly from a victim network to an FTP server they control’).
• [T1567.002] Exfiltration to Cloud Storage – Mega.io is used to move stolen archives to cloud storage outside the victim’s primary channels (‘install Mega.io and use it to export victim files directly to a cloud storage provider’).
• [T1490] Inhibit System Recovery – Commands like vssadmin and wmic are executed to delete volume shadow copies and backups (‘vssadmin delete shadows /all /quiet’ and ‘wmic shadowcopy delete’).
• [T1486] Data Encrypted for Impact – The Phobos executable encrypts files across logical drives to deny access (‘Phobos.exe contains functionality to encrypt all connected logical drives on the target host’).