Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

11/2/2017
02:18 PM
Curtis Franklin
Curtis Franklin
Curt Franklin
50%
50%

New Ransomware Attack Targets Japan

ONI is the latest ransomware attack, but this time encrypted files are just the beginning.

What's worse than ransomware? Ransomware that hides a disk wiper. And the latest attack is actually worse than that.

Japanese companies have been hit by a ransomware attack that's being called "ONI," named for the file extension it gives to encrypted files. All the files in a particular sub-directory are encrypted into a single file. Then an HTML file is placed in the directory with instructions on how the ransom can be paid.

One of the interesting things about the attack is that there are actually two versions of the ONI encryptor. One performs as just described. The other, dubbed MBR-ONI, also encrypts the master boot record of the infected computer. This is a much more serious attack.

Why two versions?
The "standard" version of ONI operates on computers that did not contain critical information -- such as network active directory servers. MBR-ONI was saved for computers that did have those types of critical information on them. The difference in attacks and attacked computers leads to some interesting inferences about the attack itself.

First, in order for the attackers to decide which systems deserved which attack, they had to be on the computer snooping around for at least some period of time. Researchers have concluded that ONI was active for between 3 and 9 months on infected machines. During that time, the attackers were looking for credentials and other sensitive organizational information, and mapping network topologies.

Next, the attackers sent a group policy across the network to delete event logs and launch the ONI encryption routines. It is generally accepted that both of these actions were aimed at covering the electronic tracks of the attackers -- any money made from ransom payments is purely incidental.

A RAT in the network
ONI entered the organization through a spear-phishing campaign using
bogus Microsoft Office documents generally disguised as invoices. When opened, these used a VB script to place a Remote Access Trojan(RAT) on the infected system -- a RAT that would spread laterally through the organization using techniques similar to that in EternalBlue, an exploit developed by the NSA and released in the Vault7 disclosure on WikiLeaks.

The ONI attack makes use of at least two programs with legitimate purposes: the Ammyy Admin remote administration tool and DiskCryptor, which organizations use to legitimately encrypt files for security and privacy purposes.

There are three factors in the ONI attacks, which so far are only targeting organizations in Japan, that companies around the world might find disturbing. First, it seems likely that this is the latest in a string of ransomware attacks aimed at very specific nations or regions. This suggests that ransomware is increasingly being used as a weapon rather than a tool for criminal enterprise.

Second, ONI uses ransomware more as a tool for covering an attacker's tracks and true purposes rather than as a criminal act in and of itself. The problem here is that a group that wants to cover its tracks rather than make money has very little incentive to actually produce the keys to un-encrypt files. Any files affected could very easily be lost forever in such an attack.

Which brings us to the third concern. Backup and recovery routines are seen as a sovereign panacea for ransomware attacks. But if the attackers had months to be planting files in a system (as they did in these cases), then infections could easily extend back in time beyond a point at which backup files could be useful. There are limits to backups, and a long infectation can easily test or break those limits.

Lessons for computer professionals are largely those covered in previous attacks: Train users on anti-phishing protocols, have effective anti-malware technology and policies in place, utilize IDS/IPS technology, and (in spite of the last point, above) make sure that your backup and recovery routines are rock solid.

ONI, like Bad Rabbit and NotPetya before it, is a harbinger of things to come. Learn from the misfortune of others and be prepared for the next major ransomware attack.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5421
PUBLISHED: 2020-09-19
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
CVE-2020-8225
PUBLISHED: 2020-09-18
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.
CVE-2020-8237
PUBLISHED: 2020-09-18
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
CVE-2020-8245
PUBLISHED: 2020-09-18
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11....
CVE-2020-8246
PUBLISHED: 2020-09-18
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-W...