| Ethereum Foundation Blog
The Russian-speaking hacking group known as RedCurl has been linked to a ransomware marketing campaign for the primary time, marking a departure within the menace actor’s tradecraft.
The exercise, observed by Romanian cybersecurity firm Bitdefender, includes the deployment of a never-before-seen ransomware pressure dubbed QWCrypt.
RedCurl, additionally known as Earth Kapre and Purple Wolf, has a historical past of orchestrating company espionage assaults aimed toward varied entities in Canada, Germany, Norway, Russia, Slovenia, Ukraine, the UK, and america. It is recognized to be lively since a minimum of November 2018.
Assault chains documented by Group-IB in 2020 entailed using spear-phishing emails bearing Human Assets (HR)-themed lures to activate the malware deployment course of. Earlier this January, Huntress detailed assaults mounted by the menace actor concentrating on a number of organizations in Canada to deploy a loader dubbed RedLoader with “easy backdoor capabilities.”
Then final month, Canadian cybersecurity firm eSentire revealed RedCurl’s use of spam PDF attachments masquerading as CVs and Cowl letters in phishing messages to sideload the loader malware utilizing the legit Adobe executable “ADNotificationManager.exe.”
The assault sequence detailed by Bitdefender traces the identical steps, utilizing mountable disk picture (ISO) recordsdata disguised as CVs to provoke a multi-stage an infection process. Current throughout the disk picture is a file that mimics a Home windows screensaver (SCR) however, in actuality, is the ADNotificationManager.exe binary that is used to execute the loader (“netutils.dll”) utilizing DLL side-loading.
“After execution, the netutils.dll instantly launches a ShellExecuteA name with the open verb, directing the sufferer’s browser to https://safe.certainly.com/auth,” Martin Zugec, technical options director at Bitdefender, stated in a report shared with The Hacker Information.
“This shows a legit Certainly login web page, a calculated distraction designed to mislead the sufferer into pondering they’re merely opening a CV. This social engineering tactic offers a window for the malware to function undetected.”
 |
| Picture Supply: eSentire |
The loader, per Bitdefender, additionally acts as a downloader for a next-stage backdoor DLL, whereas additionally establishing persistence on the host by way of a scheduled job. The newly retrieved DLL is then executed utilizing Program Compatibility Assistant (pcalua.exe), a way detailed by Pattern Micro in March 2024.
The entry afforded by the implant paves the way in which for lateral motion, permitting the menace actor to navigate the community, collect intelligence, and additional escalate their entry. However in what seems to be a serious pivot from their established modus operandi, one such assault additionally led to the deployment of ransomware for the primary time.
“This centered concentrating on could be interpreted as an try and inflict most injury with minimal effort,” Zugec stated. “By encrypting the digital machines hosted on the hypervisors, making them unbootable, RedCurl successfully disables the whole virtualized infrastructure, impacting all hosted providers.”
The ransomware executable, in addition to using the deliver your individual weak driver (BYOVD) approach to disable endpoint safety software program, takes steps to collect system data previous to launching the encryption routine. What’s extra, the ransom notice dropped following encryption seems to be impressed by LockBit, HardBit, and Mimic teams.
“This observe of repurposing present ransom notice textual content raises questions in regards to the origins and motivations of the RedCurl group,” Zugec stated. “Notably, there is no such thing as a recognized devoted leak website (DLS) related to this ransomware, and it stays unclear whether or not the ransom notice represents a real extortion try or a diversion.”
Source link