Source: www.govinfosecurity.com – Author:
Fraud Management & Cybercrime , Ransomware
New Ransomware Group Deploys Rust-Based Tools in Attacks Prajeet Nair (@prajeetspeaks) • October 23, 2024
A recently constituted and apparently well-resourced ransomware player is developing and testing tools to disable security defenses, including a method that exploits a vulnerability in drivers to bypass protection systems.
See Also: Code Red: How KnowBe4 Exposed a North Korean IT Infiltration
Researchers at Eset uncovered malware linked to the deployment of Embargo ransomware, which uses a custom loader and an endpoint detection killer. Embargo first surfaced in April amid an ongoing shakeup in the ransomware world propelled by law enforcement crackdowns and the unexpected exit of mainstay BlackCat (see: RansomHub Hits Powered by Ex-Affiliates of LockBit, BlackCat).
The group claims ten victims on its dark web leak site including an Australian non-bank lender, a South Carolina police department and an Idaho community hospital. A June interview with a self-proclaimed Embargo representative said the group works on the ransomware-as-as-service model, with affiliate keeping up to 80% of any extortion payment.
The toolkit spotted by Eset comprises two primary components: MDeployer, a loader designed to deploy Embargo’s ransomware and other payloads, and MS4Killer, an EDR killer that disables endpoint detection and response systems by exploiting vulnerable drivers.
Both MDeployer and MS4Killer are written in Rust. The language’s memory safety features and low-level capabilities make it effective for creating efficient and resilient malware. Eset researchers said Rust allows Embargo to target both Windows and Linux systems.
Once deployed on a compromised system, the MDeployer tool decrypts and executes the MS4Killer payload, followed by the Embargo ransomware. One technique the deployer uses is rebooting infected computers into Safe Mode, a minimum-functionality operating system mode that has most cybersecurity measures and protections disabled.
The versions of MDeployer and MS4Killer observed in each intrusion varied slightly, Eset researchers said, indicating that the Embargo group is actively developing and refining its toolkit. In one case, researchers found two versions of MDeployer in a single intrusion, suggesting that the attackers tweaked the tool after a failed attempt.
MS4Killer is designed to disable security products by leveraging a bring your own vulnerable driver technique. MS4Killer was likely inspired by a proof-of-concept tool named s4killer, but Embargo enhanced its functionality to make it more effective in real-world attacks.
The tool runs in an endless loop, scanning for security processes to terminate and using multiple threads for efficient execution.
Original Post URL: https://www.govinfosecurity.com/embargo-ransomware-disables-security-defenses-a-26603
Category & Tags: –
Views: 0
