Kaseya Supply-Chain Attack

Attack Flow:

This is part of an extensive series of guides about Ransomware Protection

History Repeats Itself

Unfortunately, a similar attack, leveraging Kaseya supply-chain attack, has taken place in the past by the same threat group. On June 21st, 2019, Bleepingcomputer published an article (”Sodinokibi Ransomware Spreads Wide via Hacked MSPs, Sites, and Spam”) about how REvil group appeared to have used the MSP’s Kaseya VSA console to push a file bat file to endpoints and execute it. Once executed, it would then execute a ransomware. In addition, Cynet has also published an article about this incident and a new wave of Sodinokibi.

Cynet vs. REvil Ransomware – Detection and Prevention

Cynet Customers are protected against this ransomware by several detection mechanisms, including ransomware heuristic detection:

This alert triggers when Cynet detects suspicious behavior which can be associated with Ransomware (such as changing file extensions to “.Lock”).

As this event unfolds – CyOps and Research teams work to hunt down all available IOCs and implement them in our database so Cynet’s Customers will stay protected from the newest attack campaigns and red-team techniques.

To verify your configuration protects your critical assets against this campaign, please make sure to enable these detection mechanisms:

Forensic Artifacts (Hunting Policy)

Cynet 360 customers can utilize the forensic module to actively hunt for IOCs related to this specific campaign such as the signer certificate and the path and name of the malicious artifacts by searching for the signer “PB03 TRANSPORT LTD.”:

Searching for malicious artifacts:

Additional Recommendations

All customers using Kaseya VSA are advised to immediately shut down their VSA servers, as instructed by Kaseya’s important notice:

Technical Analysis

Kaseya VSA is a cloud-based MSP platform compromised by the REvil threat group. The threat actors distributed and installed their ransomware via Kaseya VSA using the following command:

The above command disables Windows Defender and uses a the Certutil binary to decode a dropped c:\kworking\agent.crt file, which is the initial REvil ransomware distributed using Kaseya’s infrastructure. The .crt file is the actual ransomware executable and it is stored as c:\kworking\agent.exe.

Resource Section Discovery:

We have analyzed the REvil executable and the first indicatorwe observed was a resource section that contains two additional executables:

1. Original and legitimate MsMpEng.exe – Microsoft Malware Protection Agent – 33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a

2. Malicious DLL masquerading as legitimate Windows Defender DLL called mpsvc.dll – 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd

In the following screenshot we can see the two files which are located inside the resource section indicated by the folders on the left-hand-side:

Original MsMpEng.exe and mpsvc.dll are located in C:\Program Files\Windows Defender while the REvil masqueraded payloads are dropped in the c:\windows directory.

Original mpsvc.dll location and size (right side), in comparison to the masqueraded mpsvc.dll (left side):

We have performed static and dynamic analysis, to provide a full kill chain of the REvil ransomware attack flow and how it loads the associated EXE and DLL.

In the following image, taken from x32dbg, we can see that LoadResource function is used to retrieve a handle that can be used to obtain a pointer to the first byte of the specified resource in memory.

If the function succeeds, the return value is a handle to the data associated with the resource.

As mentioned before, the .rsrc section holds two binary files. One is an EXE file, and the second is a DLL.

First MZ file in the resource section:

Second MZ file in the resource section:

The memory resource section:

Digital Signature:

The initial REvil ransomware has a valid digital signature. The masquerading mpsvc.dll on the other hand, is not signed but contains the certificate signed by PB03 TRANSPORT LTD.

• Name: PB03 TRANSPORT LTD.
• Issuer: Sectigo RSA Code Signing CA
• Thumbprint: 11FF68DA43F0931E22002F1461136C662E623366
• Serial Number: 11 9A CE AD 66 8B AD 57 A4 8B 4F 42 F2 94 F8 F0

REvil Payloads Creation:

Once the REvil Ransomware is dropped and executed, it drops two additional executables that are stored as resources (MsMpEng.exe and mpsvc.dll) into the following path:

• C:\windows\MsMpEng.exe
• C:\windows\Mpsvc.dll

They are dropped using CreateFileW and WriteFile WinAPI functions

Then, the MsMpEng.exe is spawned using the CreateProcessW WinAPI.

Since this is an original and legitimate MsMpEng.exe, it is signed and verified by Microsoft, which the threat actors used to avoid raising suspicion:

DLL Search Order Hijacking

Once MsMpEng.exe executes, it then loads mpsvc.dll by using DLL Search Order Hijacking technique (T1574.001). Since both files (and especially the malicious DLL) are dropped in the %windir% directory, the malicious DLL will be loaded as part of Windows DLL search order. you can learn more about how DLL loading is performed in Windows here: https://www.cynet.com/attack-techniques-hands-on/dlls-and-ways-they-can-hurt-us/

Threat actors took advantage of this fact and dropped the malicious mpsvc.dll in a directory where it is loaded once the MsMpEng.exe process is spawned, and the original Microsoft DLL wouldn’t be loaded.

The mpsvc.dll loads from C:\windows directory and is loaded to MsMpEng. The following screenshot shows the malicious DLL loaded into MsMpEng.exe process:

By using Cynet Forensics capabilities, we can search for loaded modules inside the process. In the screenshot below, we see the MsMpEng process and the loaded malicious mpsvc.dll.

Once the malicious mpsvc.dll, which contains the encryption logic, is loaded, the encryption process begins.

As part of the encryption process, an HKLM\SOFTWARE\Wow6432Node\BlackLivesMatter registry key is added to store the configuration information from the attack. The ransomware’s configuration consists of the ransomware extension which is used as part of the encryption.

REvil Ransomware Note and Encryption

As can be seen in the following screenshot, MsMpEng.exe contains the following memory strings that represent the ransomware note:

The following screenshot shows the ransomware note that is dropped once the encryption process is completed ([victim ID]-readme.txt):

Once the encryption process is complete, the desktop background changes to the following:

The following screenshot shows the decryption website as well as the Monero wallet provided by the REvil group:

Indicators of Compromise:

Contact Cynet CyOps
(Cynet Security Operations Center)

The Cynet CyOps available to clients for any issues 24/7, questions or comments related to Cynet 360. For additional information, you may contact us directly at:

CyOps Mailbox – [email protected]

Israel: +972 72-3369736

UK: +44 2032 909051

US : +1 (347) 474-0048