OXFORD, U.K.  — 二月 23, 2022 —

Sophos, a global leader in next-generation cybersecurity, today released new research, “Dridex Bots Deliver Entropy in Recent Attacks,” that details code similarities in the general purpose Dridex botnet and the little-known ransomware, Entropy. The similarities are in the software packer used to conceal the ransomware code, in the malware subroutines designed to find and obfuscate commands (API calls), and in the subroutines used to decrypt encrypted text.

Sophos uncovered the similarities while investigating two incidents where attackers used Dridex to deliver Entropy ransomware. These attacks targeted a media company and a regional government agency, using specially crafted, customized versions of the Entropy ransomware dynamic link library (DLL) with the target’s name embedded in the ransomware code. In both attacks, the attackers also deployed Cobalt Strike on some of the targets’ computers and exfiltrated data to cloud storage providers using the legitimate WinRAR compression tool, before launching the ransomware on unprotected computers.

“It’s not unheard of for malware operators to share, borrow or steal each other’s code, either to save themselves the effort of creating their own, intentionally mislead attribution or distract security researchers. This approach makes it harder to find evidence that corroborates a ‘family’ of related malware or to identify ‘false flags’ that can make attackers’ jobs easier and investigators’ jobs harder,” said Andrew Brandt, principal researcher at Sophos. “In this analysis, Sophos focused on aspects of the code that both Dridex and Entropy apparently used to make forensic analysis more challenging. These include the packer code, which prevents easy static analysis of the underlying malware, a subroutine that the programs use to conceal the command (API) calls they make, and a subroutine that decrypts encrypted text strings embedded within the malware. The researchers found that the subroutines in both malware have a fundamentally similar code flow and logic.”

Different Attack Methodology

In addition to finding similarities in the code, Sophos researchers found some notable differences. In the attack on the media organization, the adversaries used the ProxyShell exploit to target a vulnerable Exchange server to install a remote shell they later leveraged to spread Cobalt Strike beacons to other computers. The attackers were in the network for four months before launching Entropy at the beginning of December 2021.

In the attack on the regional government organization, the target was infected with Dridex malware through a malicious email attachment. The attackers then used Dridex to deliver additional malware and move laterally within the target’s network. The incident analysis shows that approximately 75 hours after the initial detection of a suspicious login attempt on a single machine, the attackers started to steal data and move it to a series of cloud providers.

Staying Protected

The investigation found that in both cases, the attackers were able to take advantage of unpatched and vulnerable Windows systems and abuse legitimate tools. Regular security patching and the active investigation of suspicious alerts by threat hunters and security operations teams will help to make it harder for attackers to gain initial access to a target and deploy malicious code.

Sophos endpoint products, such as Intercept X, protect users by detecting the actions and behaviors of ransomware and other attacks, such as those described in this Sophos research. 

For further information, read the article “Dridex Bots Deliver Entropy in Recent Attacks.”

关于 Sophos

Sophos 是全球领先的网络安全公司,凭借其人工智能驱动的平台和专家主导的服务,保护着全球 60 万家组织的安全。Sophos 根据各组织在不同安全成熟度的各式各样的需求提供支持,并与其共同成长,携手应对日益严峻的网络攻击。其解决方案结合机器学习、自动化、实时威胁情报以及来自 Sophos X-Ops 的前线真人专家的专业知识,提供 24/7 全天候高级威胁监控、侦测与响应服务。
Sophos 提供行业领先的托管式侦测与响应 (MDR) 服务,同时配备一整套全面的网络安全技术组合,包括端点、网络、电子邮件和云安全、扩展式侦测与响应 (XDR)、身份辨识威胁侦测与响应 (ITDR),以及下一代 SIEM。结合专家咨询服务,这些能力帮助组织主动降低风险,并更迅速地响应,提供力求在不断变化的威胁面前保持领先所需的可见性和可扩展性。
Sophos 通过全球合作伙伴生态系统进入市场,包括托管式服务提供商 (MSPs)、托管式安全服务提供商 (MSSPs)、经销商、分销商、市场集成商以及网络风险合作伙伴,为组织提供灵活的选择,使其能够在保护业务安全的同时建立值得信赖的合作关系。  Sophos 总部位于英国牛津。如欲了解更多信息,请访问 www.sophos.cn。