The US Federal Bureau of Investigation (FBI) has issued an advisory describing a ransomware affiliate that calls itself “OnePercent Group,” the Record reports. The Record notes that the OnePercent Group is an affiliate of the REvil, Maze, and Egregor ransomware gangs. The threat actor gains initial access via phishing emails.
“OnePercent Group actors gain unauthorized access to victim networks through phishing emails with a malicious zip file attachment,” the FBI says. “The zip file includes a Microsoft Word or Excel document that contains malicious macros that allow the actors to subsequently infect the victim’s system with the banking Trojan IcedID. The actors use IcedID to install and execute the software Cobalt Strike on the victim’s network to move laterally to other systems within the environment through PowerShell remoting. The actors use rclone for data exfiltration from the victim’s network. The actors have been observed within the victim’s network for approximately one month prior to deployment of the ransomware.”
The FBI says the gang exfiltrates the victim’s data before encrypting it, then holds the stolen data for ransom.
“Once the ransomware is successfully deployed, the victim will start to receive phone calls through spoofed phone numbers with ransom demands and are provided a ProtonMail email address for further communication,” the Bureau says. “The actors will persistently demand to speak with a victim company’s designated negotiator or otherwise threaten to publish the stolen data. When a victim company does not respond, the actors send subsequent threats to publish the victim company’s stolen data via the same ProtonMail email address.”
The Bureau offers the following technical controls for organizations, but unfortunately forgot one of the most important ones when bad actors come in with phishing attacks: train those users with frequent simulated phishing attacks.
- Back-up critical data offline.
- Ensure administrators are not using ‘Admin Approval’ mode.
- Implement Microsoft LAPS, if possible.
- Ensure copies of critical data are in the cloud or on an external hard drive or storage device. This information should not be accessible from the compromised network.
- Secure your back-ups and ensure data is not accessible for modification or deletion from the system where the original data resides.
- Keep computers, devices, and applications patched and up-to-date.
- Consider adding an email banner to emails received from outside your organization.
- Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs.
- Audit user accounts with administrative privileges and configure access controls with least privilege in mind.
- Implement network segmentation.
- Use multi-factor authentication with strong passphrases.
New-school security awareness training can give your organization an essential layer of defense by teaching your employees to recognize phishing and other social engineering attacks.
The Record has the full story.
Here's how it works:
