Report Provides Updates on July’s Maui Ransomware Incident

Cybersecurity researchers from Kaspersky have printed a new advisory furnishing additional complex details and attribution findings relating to the Maui ransomware incident unveiled by the Cybersecurity and Infrastructure Security Agency (CISA) in July.

The report also extends CISA’s “first seen” day from May 2021 to April 15 2021, and the geolocation of the focus on to other international locations, such as Japan, India, Vietnam and Russia.

“Because the malware in this early incident was compiled on April 15th, 2021, and compilation dates are the exact for all acknowledged samples, this incident is quite possibly the initially ever involving the Maui ransomware,” Kaspersky wrote.

In addition, the security experts stated that even though CISA did not present “useful information” that would url the ransomware to a North Korean actor in its advisory, Kaspersky did deal with to make this kind of a connection.

“We established that close to 10 several hours prior to deploying Maui to the preliminary focus on method, the team deployed a variant of the very well-acknowledged DTrack malware to the concentrate on, preceded by 3proxy months earlier,” Kaspersky explained.

Specially, the Kaspersky Risk Attribution Engine (KTAE) recognized the DTrack malware from the target contained a substantial diploma of code similarity (84%) with beforehand recognized DTrack malware.

“This data issue, along with other folks, should openly assist solidify the attribution to the Korean-speaking APT [Advanced Persistent Threat] Andariel, also regarded as Silent Chollima and Stonefly, with reduced to medium self-confidence.”

From a specialized standpoint, the actor driving these attacks reportedly employed respectable proxy and tunneling applications just after first infection or deployed them to preserve entry. They would then have made use of Powershell scripts and Bitsadmin to download added malware.

Kaspersky also stated that dwell time in just focus on networks in some scenarios lasted for months prior to action and that the ransomware deployment strategies observed on a world wide scale shown ongoing fiscal motivations and scale of interest.

“Our exploration suggests that the actor is somewhat opportunistic and could compromise any enterprise about the entire world, regardless of their line of enterprise, as prolonged as it enjoys excellent monetary standing,” the advisory examine.

“It is probable that the actor favors susceptible Internet-exposed web expert services. In addition, the Andariel deployed ransomware selectively to make money profits.”

The Kaspersky report arrives weeks immediately after the US federal government enhanced its reward for information and facts on North Korean state-joined hackers to $10m.

Some elements of this write-up are sourced from:
www.infosecurity-journal.com