Ryuk ransomware now self-spreads to other Windows LAN devices

A new Ryuk ransomware variant with worm-like capabilities that allow it to spread to other devices on victims’ local networks has been discovered by the French national cyber-security agency while investigating an attack in early 2021.

“Through the use of scheduled tasks, the malware propagates itself – machine to machine – within the Windows domain,” ANSSI (short for Agence Nationale de la Sécurité des Systèmes d’Information) said in a report published today.

“Once launched, it will thus spread itself on every reachable machine on which Windows RPC accesses are possible.”

Self-replication to other network devices

To propagate itself over the local network, the new Ryuk variant lists all the IP addresses in the local ARP cache and sends what looks like Wake-on-LAN (WOL) packets to each of the discovered devices. It then mounts all sharing resources found for each device so that it can encrypt the contents.

Ryuk’s ability to mount and encrypt remote computers’ drives was previously observed by Advanced Intelligence CEO Vitali Kremez last year.

What makes this new Ryuk sample different is its capability to copy itself to other Windows devices on the victims’ local networks.

Additionally, it can execute itself remotely using scheduled tasks created on each subsequently compromised network host with the help of the legitimate schtasks.exe Windows tool.

The Ryuk variant analyzed in this document does have self-replication capabilities. The propagation is achieved by copying the executable on identified network shares. This step is followed by the creation of a scheduled task on the remote machine. [..] Some filenames were identified for this copy: rep.exe and lan.exe. – ANSSI

While it doesn’t use an exclusion mechanism that would prevent it from re-encrypting devices, ANSSI says that the new variant can still be blocked from infecting other hosts on the network by changing the password of the privileged domain account it uses for propagation to other hosts.

“One way to tackle the problem could be to change the password or disable the user account (according to the used account) and then proceed to a double KRBTGT domain password change,” ANSSI said.

“This would induce many disturbances on the domain – and most likely require many reboots but would also immediately contain the propagation. Other propagation containment approaches could also be considered, especially through the targeting of the malware execution environment.”

Indicators of compromise (IOCs) associated with this new Ryuk variant can be found here.

The Ryuk ransomware gang

Ryuk is a ransomware-as-a-service (RaaS) group first spotted in August 2018 that has left behind a long list of victims.

RaaS gangs are known for running private affiliate programs where affiliates can submit applications and resumes to apply for membership.

Ryuk is at the top of the RaaS rankings, with its payloads being discovered in roughly one in three ransomware attacks throughout the last year.

The group delivers payloads as part of multi-stage attacks using Emotet, BazarLoader, or TrickBot infection vectors for a quick way into their targets’ networks.

Ryuk affiliates have been behind a massive wave of attacks on the US healthcare system starting with November 2020. They commonly ask for huge ransoms, having collected $34 million from just one victim last year.

After following the money circuit from Ryuk ransomware victims, security researchers from threat intelligence companies Advanced Intelligence and HYAS estimate that the RaaS operation made at least $150 million.

During the third quarter of 2020, Ryuk affiliates have been observed hitting, on average, roughly 20 companies every week.

Source: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/?&web_view=true