Cisco Talos analyzed over 1,000 Phobos samples to identify prolific variants, common affiliate TTPs, and the evolving Phobos affiliate structure, including signs of a centralized decryption key and possible ransomware-as-a-service dynamics. The report highlights multiple active variants (Eking, Eight, Elbie, Devos, Faust), dispersed contacts across affiliates, and targeted attacks on high-value servers to pressure payouts. #Phobos #8Base
Keypoints
- Talos identified the most prolific Phobos variants: Eking, Eight, Elbie, Devos and Faust.
- Affiliates use similar TTPs to deploy Phobos and often target high-value servers to pressure victims into paying.
- Phobos appears closely managed by a central authority, with a single private decryptor key across observed campaigns.
- Phobos may be sold as ransomware-as-a-service (RaaS), evidenced by hundreds of contact emails/IDs and a dispersed affiliate base.
- Phobos is an evolution of Dharma/Crysis; minimal developments since 2019 despite its popularity.
- Intrusion activity includes targeted exchanges servers, lateral movement, credential dumping tools, and extensive post-compromise tooling and persistence.
MITRE Techniques
- [T1021.001] Remote Desktop Protocol – The attackers enabled RDP as part of post-compromise persistence and access. Quote: “Finally, the script configures various Registry entries responsible for enabling RDP and disabling network-level authentication.”
- [T1112] Modify Registry – The attackers disable UAC and adjust registry keys to enable persisted access and privileges. Quote: “The script disables User Account Control (UAC) on the system by setting the following Registry entry.”
- [T1548.002] Bypass User Account Control – Accessibility feature abuse to spawn SYSTEM-level cmd without authentication. Quote: “enable the accessibility features present on the Windows logon screen to spawn a SYSTEM-level command prompt without requiring previous authentication.”
- [T1562.001] Impair Defenses – Uninstalling endpoint protection software to minimize detection. Quote: “the attacker attempted to uninstall endpoint protection software on compromised hosts to minimize detection.”
- [T1070.001] Clear Windows Event Logs – Batch file to wipe event logs to hinder forensics. Quote: “One batch file clears Windows event logs on compromised systems to minimize forensic artifacts and make detection more difficult.”
- [T1490] Inhibit System Recovery – Deleting Volume Shadow Copies to impede recovery. Quote: “delete Volume shadow copies, likely to make recovery following Phobos deployment more difficult.”
- [T1486] Data Encrypted for Impact – Phobos encrypts files after defenses are disabled. Quote: “deploy the Phobos ransomware, encrypting the files in the server.”
- [T1003.001] OS Credential Dumping – Use of Mimikatz/LaZagne for credential access. Quote: “includes the LaZagne and Mimikatz utilities.”
- [T1046] Network Service Scanning – Network scanning to find open services for lateral movement. Quote: “Network Scanner (NS.exe): An executable used to scan the network for open services and move laterally over the network.”
Indicators of Compromise
- [File Name] info.hta – Ransom note dropped on the user’s Desktop. Context: “the ransom note “info.hta” was dropped to the user’s Desktop with details on how to contact the attacker.”
- [File Extension] .id-3253.[musonn@airmail[.]cc].eking – Variant-specific file extension used in Phobos payloads.
- [Domain] airmail.cc – Email provider used by Phobos affiliates. Context: “email providers… like Proton Mail” and the example shows airmail[.]cc in the extension.
- [Domain] gmx.com – Common email provider used by affiliates. Context: “gmx[.]com” in the table of providers.
- [Domain] onionmail.org – IM provider used by some affiliates. Context: “onionmail[.]org” in the table of providers.
- [Domain] qq.com – IM provider observed for affiliates. Context: “QQ[.]com” in the table of providers.
- [Email Address] [email protected] – Example contact used in the variant extension. Context: part of the extension string.
- [IM/Contact] ICQ@HONESTHORSE – Example contact observed in the affiliate communications. Context: included in the table of contacts.
- [IM/Contact] ICQ@VIRTUALHORSE – Another contact observed in the table. Context: included in the table of contacts.
Read more: https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/