X-Industry

The first sample of RomCom ransomware was observed in early July 2023 on a publicly available file scanning site, about the same time as the first victim posted on its data leak site on 13 July 2023. Like most ransomware, this ransomware encrypts files on victims' Windows machines and demands a ransom to decrypt them via dropped ransom notes.

Infection Vector - Online reports indicate that the Russia-based RomCom group, or Storm-0978, is deploying the Underground ransomware.  This threat group is known to exploit CVE-2023-36884 (Microsoft Office and Windows HTML RCE Vulnerability), which could be the infection vector for the ransomware.[1] 

FortiGuard Labs published an Outbreak Alert on CVE-2023-36884 on 13 July 2024.

Outbreak Alert: Microsoft Office and Windows HTML RCE Vulnerability - The group may use other common infection vectors such as email and purchasing access from an Initial Access Broker (IAB).

Attack Method - Once executed, the Underground ransomware deletes shadow copies with the following command:

• exe delete shadows /all /quiet

 The ransomware sets the maximum time that a RemoteDesktop/TerminalServer session can remain active on the server to 14 days (14 days after the user disconnects) using the following command:

 reg.exe add HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services / v MaxDisconnectionTime / t REG_DWORD / d 1209600000 / f

It then stops the MS SQL Server service with the following command:

net.exe stop MSSQLSERVER /f /m

The ransomware then creates and drops a ransom note named “!!readme!!!.txt”:

Figure 1: The Underground ransomware ransom note

While the ransomware encrypts files, it does not change or append file extensions.

Figure 2: A text file before file encryption

Figure 3: A text file after file encryption

It also avoids encrypting files with the following extensions:

The ransomware creates and executes temp.cmd, which performs the following actions:

• Deletes the original ransomware file
• Obtains a list of Windows Event logs and deletes them
• Victimology and Data Leak Site

The Underground ransomware has a data leak site that posts victim information, including data stolen from victims.  Currently, the data leak site lists 16 victims, with the most recent victim posted on 3 July 2024.  Below is a breakdown of the victims and their verticals:

Figure 4: The data leak site for Underground ransomware

The data leak site also includes a drop-down box with a list of industries the ransomware group is targeting or is allowed to target.

Figure 5: One of the victims of the data leak site

The Underground ransomware group also created a Telegram channel on 21 March 2024.
Figure 6: The Underground ransomware Telegram channel

According to the Telegram channel, the ransomware group has made victims' stolen information available on Mega, a cloud storage service provider that is being abused
Figure 7: Telegram channel containing links to the stolen information on Mega

IOCs

Underground Ransomware File IOCs

This article is shared at no charge and is for educational and informational purposes only.

We want to thank Fortinet Labs for this report.  They have been providing excellent collection and analysis for many years, and this is yet another example.  Red Sky Alliance provides Cyber Threat Analysis and Intelligence Services for our clients.  We provide valuable indicators of compromised information via a notification service (RedXray) or an analysis service (CTAC).  For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225 or feedback@redskyalliance.com    

• Reporting: https://www.redskyalliance.org/
• Website: https://www.redskyalliance.com/
• LinkedIn: https://www.linkedin.com/company/64265941 

 Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefing
https://register.gotowebinar.com/register/5378972949933166424

[1] https://www.fortinet.com/blog/threat-research/ransomware-roundup-underground?lctg=141970831