Attacks Target Organizations With Remote Operations and Vulnerable RDPs. “Have fun, bro!”: Dharma’s Entry-Level Color by Numbers Ransomware Toolkit Thrives Alongside Advanced Multi-Million Dollar Ransomware Attacks

OXFORD, U.K. — 8月 12, 2020 —

Sophos, a global leader in next-generation cybersecurity, today published, “Color by Numbers: Inside a Dharma Ransomware-as-a-Service (RaaS) Attack,” which provides the first in-depth look at an automated attack script and toolset created by the ransomware operators and provided to cybercriminal buyers together with back-end infrastructure and malicious tools. The report also shows how Dharma is targeting small and mid-sized businesses (SMBs) in 2020.

Dharma has been known since 2016, and is one of the most profitable ransomware families around, due to its mass-market, service-based business model. Various iterations of its source code have been dumped online or offered for sale, so many variants of the code now exist. 

The main targets for the Dharma RaaS attacks that Sophos analyzed are SMBs, with 85% of attacks seen in 2020 focusing on exposed access tools like Remote Desktop Protocol (RDP). This is according to ransomware recovery company, Coveware, which also found that Dharma ransom demands were generally quite low, at $8,620 USD, on average.

“Dharma is fast-food franchise ransomware: widely and easily available to just about anyone,” said Sean Gallagher, senior threat researcher at Sophos. “Dharma’s ransomware-as-a-service offerings expand the range of people who can execute devastating ransomware attacks. That’s worrying enough in itself in normal times. But right now, with many businesses adapting to the pandemic and accommodating a need for rapid support for remote workers, and IT staffs stretched thin, the risks from these attacks is magnified. The need to equip and enable an unexpectedly remote workforce has left small companies with vulnerable infrastructure and devices, and hindered the ability of IT support staff to adequately monitor and manage systems the way they normally would.”

As noted in the Sophos report, once Dharma customers, known as affiliates, have purchased the tools and compromised their target, they rely almost entirely on a menu-driven PowerShell script that installs and launches the components required to spread ransomware across the target’s network. When the master script is executed, it identifies itself as “Toolbox” and launches the attack with the message, “Have fun, bro!”

The attack process relies heavily on the abuse of open source tools, as well as freeware versions of commercial tools. Decryption is a surprisingly complex two-stage process. Targets that contact affiliates for recovery keys are given a first-stage tool that extracts details of all of their encrypted files. Affiliates then share this extracted data is with their operators, who provide a second-stage decryption key for the files. How effective this process is in actually restoring data for the targets depends greatly on the skills and mood of the affiliates, according to the research. For instance, Sophos occasionally observed affiliates holding back some of the keys as leverage to make additional ransom demands.

“With so many multi-million dollar ransom demands, high profile targets and advanced adversaries like WastedLocker now making the headlines, it can be easy to forget that threats like Dharma are alive and well, and enabling a whole other rung of cybercriminals to hit multiple smaller targets to rake in a fortune, eight thousand dollars at a time,” said Gallagher.

Advice for Defenders

  • Shut down internet-facing remote desktop protocol (RDP) to deny cybercriminals access to networks. If you need access to RDP, put it behind a VPN connection
  • Check that you have a full inventory of all devices connected to your network and always install the latest security updates, as soon as they are released, on all the devices and servers on your network
  • Keep regular backups of your most important and current data on an offline storage device
  • Be aware of the five early indicators an attacker is present to stop ransomware attacks
  • Remember, there is no single silver bullet for security, and a layered, defence-in-depth security model is essential

For additional information, please reference SophosLabs Uncut.

ソフォスについて

ソフォスは、サイバーセキュリティ業界のリーダー企業として、AI を駆使したプラットフォームや精鋭スタッフによるサービスを世界中の 600,000社以上のお客様にご利用いただいています。セキュリティの成熟度にかかわらず、あらゆるお客様のご要望にお応えし、サイバー攻撃を撃退すべくお客様とともに成長を続けています。機械学習や、自動化、リアルタイムの脅威インテリジェンスに、Sophos X-Ops の最前線スタッフから得た専門知識を組み合わせて、高度な脅威監視、検出、対応を 24時間 365日体制で行っています。
ソフォスは、業界最先端の MDR (managed detection and response) を提供しているのに加えて、エンドポイントをはじめ、ネットワーク、メール、クラウドセキュリティ、XDR (extended detection and response)、ITDR (identity threat detection and response)、次世代の SIEM まで、サイバーセキュリティテクノロジーのあらゆるラインナップを取り揃えています。さらに、専門家によるアドバイザリーサービスも提供しており、組織はこれらを組み合わせて利用することで、リスクをあらかじめ減らし、迅速な対応をとれるようになるだけでなく、進化し続ける脅威の一歩先をいくために必要な可視性および拡張性を確保することが可能となります。
ソフォスは、グローバルに広がるパートナーエコシステムを通じて市場展開しており、お客様は、MSP (Managed Service Provider)、MSSP (Managed Security Service Provider) や、リセラー、ディストリビューターのほか、マーケットプレイスにおける統合、ソフォスのサイバーリスクパートナーまで、信頼できる関係性を自由にお選びいただけます。  ソフォス本社は英国のオックスフォードにあります。詳細については www.sophos.com をご覧ください。