Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

11/2/2017
02:18 PM
Curtis Franklin Jr.
Curtis Franklin Jr.
Curt Franklin
50%
50%

New Ransomware Attack Targets Japan

ONI is the latest ransomware attack, but this time encrypted files are just the beginning.

What's worse than ransomware? Ransomware that hides a disk wiper. And the latest attack is actually worse than that.

Japanese companies have been hit by a ransomware attack that's being called "ONI," named for the file extension it gives to encrypted files. All the files in a particular sub-directory are encrypted into a single file. Then an HTML file is placed in the directory with instructions on how the ransom can be paid.

One of the interesting things about the attack is that there are actually two versions of the ONI encryptor. One performs as just described. The other, dubbed MBR-ONI, also encrypts the master boot record of the infected computer. This is a much more serious attack.

Why two versions?
The "standard" version of ONI operates on computers that did not contain critical information -- such as network active directory servers. MBR-ONI was saved for computers that did have those types of critical information on them. The difference in attacks and attacked computers leads to some interesting inferences about the attack itself.

First, in order for the attackers to decide which systems deserved which attack, they had to be on the computer snooping around for at least some period of time. Researchers have concluded that ONI was active for between 3 and 9 months on infected machines. During that time, the attackers were looking for credentials and other sensitive organizational information, and mapping network topologies.

Next, the attackers sent a group policy across the network to delete event logs and launch the ONI encryption routines. It is generally accepted that both of these actions were aimed at covering the electronic tracks of the attackers -- any money made from ransom payments is purely incidental.

A RAT in the network
ONI entered the organization through a spear-phishing campaign using bogus Microsoft Office documents generally disguised as invoices. When opened, these used a VB script to place a Remote Access Trojan(RAT) on the infected system -- a RAT that would spread laterally through the organization using techniques similar to that in EternalBlue, an exploit developed by the NSA and released in the Vault7 disclosure on WikiLeaks.

The ONI attack makes use of at least two programs with legitimate purposes: the Ammyy Admin remote administration tool and DiskCryptor, which organizations use to legitimately encrypt files for security and privacy purposes.

There are three factors in the ONI attacks, which so far are only targeting organizations in Japan, that companies around the world might find disturbing. First, it seems likely that this is the latest in a string of ransomware attacks aimed at very specific nations or regions. This suggests that ransomware is increasingly being used as a weapon rather than a tool for criminal enterprise.

Second, ONI uses ransomware more as a tool for covering an attacker's tracks and true purposes rather than as a criminal act in and of itself. The problem here is that a group that wants to cover its tracks rather than make money has very little incentive to actually produce the keys to un-encrypt files. Any files affected could very easily be lost forever in such an attack.

Which brings us to the third concern. Backup and recovery routines are seen as a sovereign panacea for ransomware attacks. But if the attackers had months to be planting files in a system (as they did in these cases), then infections could easily extend back in time beyond a point at which backup files could be useful. There are limits to backups, and a long infectation can easily test or break those limits.

Lessons for computer professionals are largely those covered in previous attacks: Train users on anti-phishing protocols, have effective anti-malware technology and policies in place, utilize IDS/IPS technology, and (in spite of the last point, above) make sure that your backup and recovery routines are rock solid.

ONI, like Bad Rabbit and NotPetya before it, is a harbinger of things to come. Learn from the misfortune of others and be prepared for the next major ransomware attack.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-33818
PUBLISHED: 2021-06-18
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
CVE-2021-33820
PUBLISHED: 2021-06-18
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of-service.
CVE-2021-33822
PUBLISHED: 2021-06-18
An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
CVE-2020-18442
PUBLISHED: 2021-06-18
Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".
CVE-2021-3604
PUBLISHED: 2021-06-18
Secure 8 (Evalos) does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database.