Pay attention to this one. Despite only targeting Russian companies, the use of custom self-made malware and decidedly creative phishing campaigns makes them a potential danger.
OldGremlin first showed in in late March of this year. Singapore-based GroupIB took note and has been tracking them continually.
What makes this new kid on the block so interesting is found in the malware and social engineering they use. According to Group-IB:
- Their backdoors are custom, dubbed TinyPosh and TinyNode
- As is their ransomware, dubbed TinyCrypt
- They are using third-party software for reconnaissance, lateral movement, taking screenshots, and email password recovery
- They impersonate well-known individuals
- Their phishing gambits are unique; one example was that of a journalist wanting to setup an interview. Once scheduled, the second email (the malicious one) included a link to the questions.
Their demonstrated expertise in social engineering tells me that you’re going to need to improve your user’s ability to spot a suspicious email a mile away. Security Awareness Training provides the education needed – both practically speaking with examples of attack, but also strategically, teaching the user about the need to be vigilant as part of the organization’s overall security posture.
To date, this Russia-based ransomware group has only targeted prominent Russian companies, but their methods show real promise. Once they get their hands on someone that speaks and can write in other languages, it’s a safe bet you’ll see them showing up in your neck of the woods.
Here's how it works:
