A Look at a Ransomware Affiliate



Look at a Ransomware AffiliateThe US Federal Bureau of Investigation (FBI) has issued an advisory describing a ransomware affiliate that calls itself “OnePercent Group,” the Record reports. The Record notes that the OnePercent Group is an affiliate of the REvil, Maze, and Egregor ransomware gangs. The threat actor gains initial access via phishing emails.

“OnePercent Group actors gain unauthorized access to victim networks through phishing emails with a malicious zip file attachment,” the FBI says. “The zip file includes a Microsoft Word or Excel document that contains malicious macros that allow the actors to subsequently infect the victim’s system with the banking Trojan IcedID. The actors use IcedID to install and execute the software Cobalt Strike on the victim’s network to move laterally to other systems within the environment through PowerShell remoting. The actors use rclone for data exfiltration from the victim’s network. The actors have been observed within the victim’s network for approximately one month prior to deployment of the ransomware.”

The FBI says the gang exfiltrates the victim’s data before encrypting it, then holds the stolen data for ransom.

“Once the ransomware is successfully deployed, the victim will start to receive phone calls through spoofed phone numbers with ransom demands and are provided a ProtonMail email address for further communication,” the Bureau says. “The actors will persistently demand to speak with a victim company’s designated negotiator or otherwise threaten to publish the stolen data. When a victim company does not respond, the actors send subsequent threats to publish the victim company’s stolen data via the same ProtonMail email address.”

The Bureau offers the following technical controls for organizations, but unfortunately forgot one of the most important ones when bad actors come in with phishing attacks: train those users with frequent simulated phishing attacks. 

  • Back-up critical data offline.
  • Ensure administrators are not using ‘Admin Approval’ mode.
  • Implement Microsoft LAPS, if possible.
  • Ensure copies of critical data are in the cloud or on an external hard drive or storage device. This information should not be accessible from the compromised network.
  • Secure your back-ups and ensure data is not accessible for modification or deletion from the system where the original data resides.
  • Keep computers, devices, and applications patched and up-to-date.
  • Consider adding an email banner to emails received from outside your organization.
  • Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs.
  • Audit user accounts with administrative privileges and configure access controls with least privilege in mind.
  • Implement network segmentation.
  • Use multi-factor authentication with strong passphrases.

New-school security awareness training can give your organization an essential layer of defense by teaching your employees to recognize phishing and other social engineering attacks.

The Record has the full story


Free Ransomware Simulator Tool

Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RansIm-Monitor3Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 21 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/ransomware-simulator

Topics: Ransomware

Subscribe To Our Blog


Cybersecurity Awareness Month Resource Kit




Get the latest about social engineering

Subscribe to CyberheistNews