RansomBoggs: New ransomware targeting Ukraine | WeLiveSecurity

The
ESET
research
team
has
spotted
a
new
wave
of
ransomware
attacks
taking
aim
at
multiple
organizations
in
Ukraine
and
bearing
the
hallmarks
of
other
campaigns
previously
unleashed
by
the

Sandworm
APT
group.

Even
though
the
ransomware
–
called
RansomBoggs
by
ESET
and
written
in
the
.NET
framework
–
is
new,
particularly
the
way
it
is
deployed
bears
close
resemblance
to
some
past
attacks
attributed
to
the
notorious
threat
actor.

ESET
has
alerted
Ukraine’s
Computer
Emergency
Response
Team
(CERT-UA)
about
the
RansomBoggs
onslaughts,
which
were
first
detected
on
November
21^st.
Depending
on
the
variant,
RansomBoggs
is
detected
by
ESET
products
as
MSIL/Filecoder.Sullivan.A
and
MSIL/Filecoder.RansomBoggs.A.

RansomBoggs
at
a
glance

RansomBoggs
ransom
note

In
the
ransom
note
seen
above
(SullivanDecryptsYourFiles.txt),
the
authors
of
RansomBoggs
make
multiple
references
to
the
Monsters
Inc.
movie,
including
by
impersonating
James
P.
Sullivan,
the
movie’s
main
protagonist.

Once
unleashed,
the
new
ransomware
“generates
a
random
key
and
encrypts
files
using
AES-256
in
CBC
mode”
–
not
the
AES
key
length
of
128
bits
mentioned
in
the
ransom
note.
It
then
appends
the
.chsch
extension
to
the
encrypted
files.

“The
key
is
then
RSA
encrypted
and
written
to
aes.bin,”
said
ESET
researchers.
Depending
on
the
variant,
the
RSA
public
key
is
either
hardcoded
in
the
malware
sample
itself
or
provided
as
argument.

There
are
similarities
with
previous
attacks
conducted
by

#Sandworm:
a
PowerShell
script
used
to
distribute
the
.NET
ransomware
from
the
domain
controller
is
almost
identical
to
the
one
seen
last
April
during
the

#Industroyer2
attacks
against
the
energy
sector.
4/9

pic.twitter.com/fdh6A2FCXk

—
ESET
research
(@ESETresearch)

November
25,
2022

As
for
similarities
with
other
onslaughts
by
Sandworm,
the
PowerShell
script
used
to
distribute
RansomBoggs
from
the
domain
controller
is
almost
identical
to
the
one
used
in

Industroyer2
attacks
against
Ukraine’s
energy
sector
in
April
of
this
year.
The
same
script
was
used
to
deliver
data-wiping
malware
called

CaddyWiper
that
leveraged
the

ArguePatch
loader
and
hit
several
dozen
systems
in
a
limited
number
of
organizations
in
Ukraine
in
March.

Ukraine
under
fire

Sandworm
has
a
long
track
record
of
being
behind
some
of
the
world’s
most
disruptive
cyberattacks
of
the
past
near-decade.
It
last
entered
the
spotlight
just
weeks
ago
after
it
was
fingered
by
Microsoft
as
being
behind
ransomware
called

“Prestige”
that
hit
several
logistics
companies
in
Ukraine
and
Poland
in
early
October.

The
aforementioned
attacks
do
by
no
means
give
the
full
picture
of
the
various
threats
that
high-profile
Ukrainian
organizations
have
had
to
weather
this
year
alone.
For
example,
back
on
February
23^rd,
just
hours
before
Russia
invaded
Ukraine,
ESET
telemetry
picked
up

HermeticWiper
on
the
networks
of
several
Ukrainian
organizations.
The
next
day,
a
second
destructive
attack
against
a
Ukrainian
governmental
network
started,
this
time
delivering

IsaacWiper.

Indeed,
Ukraine
has
been
on
the
receiving
end
of
a
number
of
highly
disruptive
cyberattacks
by
Sandworm
since
at
least
2014,
including

BlackEnergy,

GreyEnergy
and
the
first
iteration
of

Industroyer.
The
group
was
also
behind
the

NotPetya
attack
that
swept
through
many
corporate
networks
in
Ukraine
in
June
2017
before
spreading
like
wildfire
globally
and
wreaking
havoc
in
many
organizations
worldwide.

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts