Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

11/2/2017
02:18 PM
Curtis Franklin
Curtis Franklin
Curt Franklin
50%
50%

New Ransomware Attack Targets Japan

ONI is the latest ransomware attack, but this time encrypted files are just the beginning.

What's worse than ransomware? Ransomware that hides a disk wiper. And the latest attack is actually worse than that.

Japanese companies have been hit by a ransomware attack that's being called "ONI," named for the file extension it gives to encrypted files. All the files in a particular sub-directory are encrypted into a single file. Then an HTML file is placed in the directory with instructions on how the ransom can be paid.

One of the interesting things about the attack is that there are actually two versions of the ONI encryptor. One performs as just described. The other, dubbed MBR-ONI, also encrypts the master boot record of the infected computer. This is a much more serious attack.

Why two versions?
The "standard" version of ONI operates on computers that did not contain critical information -- such as network active directory servers. MBR-ONI was saved for computers that did have those types of critical information on them. The difference in attacks and attacked computers leads to some interesting inferences about the attack itself.

First, in order for the attackers to decide which systems deserved which attack, they had to be on the computer snooping around for at least some period of time. Researchers have concluded that ONI was active for between 3 and 9 months on infected machines. During that time, the attackers were looking for credentials and other sensitive organizational information, and mapping network topologies.

Next, the attackers sent a group policy across the network to delete event logs and launch the ONI encryption routines. It is generally accepted that both of these actions were aimed at covering the electronic tracks of the attackers -- any money made from ransom payments is purely incidental.

A RAT in the network
ONI entered the organization through a spear-phishing campaign using
bogus Microsoft Office documents generally disguised as invoices. When opened, these used a VB script to place a Remote Access Trojan(RAT) on the infected system -- a RAT that would spread laterally through the organization using techniques similar to that in EternalBlue, an exploit developed by the NSA and released in the Vault7 disclosure on WikiLeaks.

The ONI attack makes use of at least two programs with legitimate purposes: the Ammyy Admin remote administration tool and DiskCryptor, which organizations use to legitimately encrypt files for security and privacy purposes.

There are three factors in the ONI attacks, which so far are only targeting organizations in Japan, that companies around the world might find disturbing. First, it seems likely that this is the latest in a string of ransomware attacks aimed at very specific nations or regions. This suggests that ransomware is increasingly being used as a weapon rather than a tool for criminal enterprise.

Second, ONI uses ransomware more as a tool for covering an attacker's tracks and true purposes rather than as a criminal act in and of itself. The problem here is that a group that wants to cover its tracks rather than make money has very little incentive to actually produce the keys to un-encrypt files. Any files affected could very easily be lost forever in such an attack.

Which brings us to the third concern. Backup and recovery routines are seen as a sovereign panacea for ransomware attacks. But if the attackers had months to be planting files in a system (as they did in these cases), then infections could easily extend back in time beyond a point at which backup files could be useful. There are limits to backups, and a long infectation can easily test or break those limits.

Lessons for computer professionals are largely those covered in previous attacks: Train users on anti-phishing protocols, have effective anti-malware technology and policies in place, utilize IDS/IPS technology, and (in spite of the last point, above) make sure that your backup and recovery routines are rock solid.

ONI, like Bad Rabbit and NotPetya before it, is a harbinger of things to come. Learn from the misfortune of others and be prepared for the next major ransomware attack.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20934
PUBLISHED: 2020-11-28
An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c.
CVE-2020-29368
PUBLISHED: 2020-11-28
An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.
CVE-2020-29369
PUBLISHED: 2020-11-28
An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.
CVE-2020-29370
PUBLISHED: 2020-11-28
An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71.
CVE-2020-29371
PUBLISHED: 2020-11-28
An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.