Hackers hid ransomware in virtual machines
Ragnar Locker gang concealed ransomware in virtual machines
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Ransomware has become an increasingly popular method for hackers to spread chaos and gain financial reward in recent years. However as traditional email phishing scams and campaigns become easier to block and detect, hackers are having to turn to new methods in order to try and snare victims
TechRadar Prospoke to Mark Loman from SophosLabs to find out about a new campaign it spotted involving a potentially critical tactic using virtual machines.
Can you explain in simple terms how the Ragnar Locker gang used the virtual machine to deploy the ransomware executable?
This is the first time we have seen virtual machines used for ransomware. The Ragnar Locker gang embedded the ransomware executable on the virtual disk image (VDI) of the virtual machine (VM). Theransomwareexecutable is not sent into the network and is not run on the physical endpoint, but runs solely in the virtual machine.
What are the tell-tale signs or tools that can be used to detect this type of attack?
On the physical machine, the actions by the ransomware in thevirtual machineare tunnelled and performed by a well-known and normally trusted process. A tell-tale sign is high CPU usage by a single process and the mass writing into existing documents and other files. The best tool to defend against this type of attack is with a security tool (anti-ransomware) that is specifically designed to detect the unusual mass file writes via behavioural monitoring with a zero-trust attitude.
As well as being a new technique, what is so threatening about this method of attack?
The attack hides the ransomware executable in a relatively large file, of a file type that security tools typically don’t process: a virtual disk image (VDI). In addition, the ransomware executable runs in a virtual machine and because of the underlying hypervisor technology, is not visible by security tools on the physical machine.
While this attempt was unsuccessful, do you think that with the increasing use of VMs this tactic will become more savvy and therefore successful?
Although this is a bold attack, it is also noisy due to its foot-print and high CPU usage. In networks that haven’t invested in ransomware protection, this attack can be successful, but I don’t think we will see this approach become common.
What type of organisations do you think are most at risk from this technique?
Since more ransomware attacks are human-operated, every organisation is a target. They all should be prepared and have a recovery plan (printed on paper). One successful spam or phishing email, an exposed RDP port, a vulnerable exploitable gateway device or stolen remote access credentials are enough for these active adversaries to gain a foothold. However, with more criminal gangs asking for millions of dollars in ransom demands, it is clear that larger organisations with more money and a bigger attack surface are at greater risk.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
What else should we know?
In the last few months, we’ve seen ransomware evolve in several ways. But the Ragnar Locker adversaries are taking ransomware to a new level and thinking outside of the box.
They are deploying a well-known and trusted hypervisor to hundreds of endpoints simultaneously, together with a pre-installed and pre-configured virtual disk image (VDI) guaranteed to run their ransomware.
“Like a ghost able to interact with the material world, their virtual machine is tailored per endpoint, so it can encrypt the local disks and mapped network drives on the physical machine from within the virtual plane and out of the detection realm of most endpoint protection products. The overhead involved to covertly run their 50 kilobyte ransomware seems like a bold, noisy move, but could pay-off in some networks that are not properly protected against ransomware.
Mark Loman is director of engineering, Threat Mitigation atSophos.
Mark Loman is director of engineering and threat mitigation at Sophos. As an ethical hacker with a passion for information security, Loman oversees a team of experienced developers responsible for delivering practical signature-less solutions. With more than 10 years of experience, Loman has a keen eye for innovating effective solutions and technology that stop zero-day cyberthreats. With in-depth knowledge of the intricate workings of modern computers and applications, Loman’s team isn’t shy when applying unconventional methods to test and create prevention techniques to battle even persistent attackers.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
After Arcane season 1 ended on a stunning cliff hanger, its creators say it was ‘always the plan’ for those characters to die in the season 2 premiere
