[BreachExchange] Ryuk ransomware strikes at least four organizations in Canada

[Destry Winant]

https://www.itworldcanada.com/article/ryuk-ransomware-strikes-at-least-four-organizations-in-canada/409893

A new strain of ransomware first reported in August is now being seen
in Canada, hitting at least four organizations here.

“I’m starting to see a certain type of ransomware called Ryuk
targeting healthcare organizations,”  Canadian cyber security lawyer
Imrad Ahmad told IT World Canada on Tuesday. “Typically ransomware
locks up your system. This one actually exfiltrates data” as well.

Ahmad, a partner and national leader of the cybersecurity law practice
at Miller Thomson LLP said his practice knows of four organizations in
the past month alone that were hit. He wouldn’t say how many of the
organizations had lost data.

Typically the ransom demanded was around 40 to 50 Bitcoin, he said,
which at current value is roughly $34,000 to $42,00.

How each were infected isn’t clear yet,

In August the U.S. Department of Health and Human Services and Check
Point Software issued alerts on this particular strain of ransomware.

The way attacks have been executed suggest the people behind it have
researched their targets well, probably infiltrating networks before
launching the ransomware, because they know where valuable data is.
Check Point in the incidents it has seen Ryuk is only used in targeted
attacks.

To maintain persistence Ryuk writes itself to the Windows Run registry
key. The ransomware will kill more than 40 processes and stop more
than 180 services from a list of predefined service and process names.
Most belong to antivirus, database, backup and document editing
software.

There are similarities between Ryuk and ransomware dubbed Hermes, seen
first in the fall of 2017, by some researchers. That led Check Point
to believe those behind Ryuk are either the same operators of the
Hermes strain, or someone has got access to the Hermes source code. It
then adds injected code for file encryption.

Protection tip

According to Check Point, it’s important to note that the malware will
attempt to write a dummy file to the Windows directory, which would
only be allowed with Admin privileges. This file will write two more
files to a subfolder in the Windows directory, one of which contains
an RSA Public key for encryption, and the second contains a hardcoded
key. But if the creation of the first dummy file fails, the malware
will sleep for a while and attempt the same another five times. If
failure persists beyond these attempts, Ryuk will simply terminate.

This is important because one of the ways to stop Ryuk is to make sure
people with Windows administration privileges have to log in with
complex passwords requiring multi-factor authentication.

Check Point said the Hermes strain is “commonly attributed” to the
North Korean threat actors dubbed the Lazarus Group,

The U.S. government report included the following recommendations to
infosec pros:

 Firewall off SMB (server message block) port 445 for internal
computers. If access to this service is required, it should be
permitted only for those IP’s that require access. i.e. 445 is
required for SCOM to push an agent install, therefore 445 should only
be allowed from that source server;
 Application blacklisting should be implemented to prevent the use of
tools such as vssadmin.exe, cmd.exe, powershell.exe and similar;
 File Integrity Monitoring should be considered and configured to
monitor file creations in “trusted” locations such as the System32
directory. This can also be used to monitor deletes, with an alert
configured to fire on excessive deletes in a row;
 Windows Security Event logs should be monitored to capture Scheduled
Task creation events – Event ID 4698;
 Registry Auditing should be enabled and monitored to capture any additions to
HKLM\Software\Microsoft\Windows\CurrentVersion\Run;
 Excessive use of known administrative privilege accounts should be
alerted on – specifically in a “one to many” behavioral configuration.
i.e. is one specific IP connecting to a large number of devices using
the same credentials in a short period of time;
 Ensure privileged accounts have a complex password that does not
include any part of the username, or application it relates to.