Barracuda Advanced Technology Group monitoring aggressive ransomware threat

This blog continues to be updated as more data becomes available.

Jump to section:

• Main


• Update 9/19/17


• Update 9/21/17


• Update 9/22/2017


• Indicators of Compromise

These attacks are wrapped in either a 'Herbalife' branded email or a generic email that impersonates a 'copier' file delivery:

These attacks have been morphing throughout the day, but they all use fake source email addresses.  The earliest examples came from Vietnam and Greece.

A third variant has appeared in the last couple of hours, which uses the subject line "Emailing - <attachment name>.

All attachments in this attack are demonstrating ransomware specific behavior.  We are currently analyzing the sample to determine which variant is being used.  This blog will be updated when we have more information.

 

There have been approximately 6,000 fingerprints, which tells us that these attacks are being automatically generated using a template that randomizes parts of the files.  The names of payload files and the domains used for downloading secondary payloads have been changing in order to stay ahead anti-virus engines.

We will continue to monitor this threat and provide updates as they are available.

Barracuda email security customers and Advanced Threat Protection customers are protected from this attack.  All of the emails were blocked by Barracuda’s email filtering security appliances and SaaS products. We are able to monitor and analyze threat activity through our filters without being directly affected by attackers. None of Barracuda’s products were used as a weapon during this attack and the Barracuda network and Barracuda’s customers were not affected at any point.

Update  9/19/17 6:30pm PST:  

Barracuda researchers have confirmed that this attack is using a Locky variant with a single identifier.  The identifier allows the attacker to identify the victim so that when the victim pays the ransom, the attacker can send that victim the decryptor.  In this attack, all victims get the same identifier, which means that victims who pay the ransom will not get a decryptor because it will be impossible for the criminal to identify them.

This attack is also checking the victim computer language files, which may lead to an internationalized version of this attack in the future.

Barracuda systems have now blocked about 27 million of these emails, and the attack is continuing at the same pace as it has been throughout the campaign.

End of Update 1

Update 9/21/17 11:30am PST:  

Barracuda researchers are now observing two new wrappers in this attack.  The first impersonates a voicemail message, using the subject line "New voice message [phone number] in mailbox [phone number] from ["phone number"] [<alt phone number>]."   At this time the domain in the body of the email is not returning suspicious activity. The bulk of this attack originated in Serbia.

We are also seeing a wrapper that impersonates invoicing from marketplace.amazon.uk. Despite the spoofed domain, there's no increased targeting of UK domains.

We are still observing approximately 1 million of these attacks per hour, though we may see an uptick with the new wrappers.

We will continue to update this blog with new information as it becomes available.

End of Update 2

Update 9/22/2017 1:40pm PST:

There are new rotating wrappers for this attack, which are essentially an empty email with just a link. The subject line and the name of the attachment file vary for each of the variants. All three types (IMG, SCAN and JPEG) are seen with each example of the payload signature -- that is the sending program is sending all 3 types of wrapper. This is the first time we've seen this. Previously, each example of the payload file had a unique wrapper template and subject line.



###

###

###
Our systems have now blocked approximately 70 million of these emails.

We will continue to update this post as more information becomes available.

End of Update 3

Indicators of Compromise:

6N01001755_1.7z ("Herbalife")

• MD5  --  1b38a94f7ea7ef17a88ace43bb1e8780


• SHA1  --  213776b57d7c28e7152d8ce81298a6ff67cf9f10


• SHA256  --  83a7891731aacbe25bb5f5e2ba0c8dabed379be8c6fbc25db78c0d771a20a432

10008009158.7z ("Emailing")

• MD5  --  8b9e81492275ba57a7283b4a48c61240


• SHA1  --  167e625c11063c3fa5edb3d6755d79c7d9b88d69


• SHA256  --  1b80b24b7195960a74cc10dbbc9685ae229443a80d11c7fe7a9c8fdd4e59840d


• 188.190.7.128


• 188.190.7.128


• http://fulcar.info/p66/IUGiwe8

We will update this section as more data becomes available  

End of Indicators of Compromise

 

---

Eugene is the Lead Platform Architect working on deep-learning technology for Barracuda, and leader of the Barracuda Content Intelligence Team.  Connect with him on LinkedIn here.