Emerging Threat Actor DEV-0569 finds new ways to deliver Royal ransomware, various payloads

guest · Nov 18, 2022

Kevin Poireault, Reporter, Infosecurity Magazine - November 18, 2022

DEV-0569, a new threat actor whose activity can be traced back as early as August 2022, developed new tools to deliver the Royal ransomware, claimed Microsoft Security Threat Intelligence in a post published on November 17, 2022.
Click to expand...

This emerging group, for which Microsoft still uses a temporary ‘DEV-####’ designation, meaning they are unsure about its origin or identity, typically relies on malvertising and phishing link vectors.

They point to a malware downloader called BATLOADER, posing as legitimate software installers such as TeamViewer, Adobe Flash Player and Zoom, or updates embedded in spam emails, fake forum pages, and blog comments to deploy the Royal ransomware, which first emerged in September 2022 and is being distributed by multiple threat actors.
Click to expand...

When launched, BATLOADER uses MSI Custom Actions to launch malicious PowerShell activity or run batch scripts to aid in disabling security solutions and lead to the delivery of various encrypted malware payloads that is decrypted and launched with PowerShell commands.

Finally, in September and October, Microsoft saw activity where DEV-0569 used the open-source NSudo tool to attempt to disable antivirus solutions.
Click to expand...

Microsoft: DEV-0569 finds new ways to deliver Royal ransomware, various payloads

November 17, 2022
Recent activity from the threat actor that Microsoft tracks as DEV-0569, known to distribute various payloads, has led to the deployment of the Royal ransomware, which first emerged in September 2022 and is being distributed by multiple threat actors. Observed DEV-0569 attacks show a pattern of continuous innovation, with regular incorporation of new discovery techniques, defense evasion, and various post-compromise payloads, alongside increasing ransomware facilitation.
Click to expand...

DEV-0569 notably relies on malvertising, phishing links that point to a malware downloader posing as software installers or updates embedded in spam emails, fake forum pages, and blog comments. In the past few months, Microsoft security researchers observed the following tweaks in the group’s delivery methods:

Use of contact forms on targeted organizations’ websites to deliver phishing links

Hosting fake installer files on legitimate-looking software download sites and legitimate repositories to make malicious downloads look authentic to targets, and

Expansion of their malvertising technique by using Google Ads in one of their campaigns, effectively blending in with normal ad traffic

Click to expand...

guest · Jan 24, 2023

Ransomware access brokers use Google ads to breach your network
By Lawrence Abrams @LawrenceAbrams - January 24, 2023

A threat actor tracked as DEV-0569 uses Google Ads in widespread, ongoing advertising campaigns to distribute malware, steal victims' passwords, and ultimately breach networks for ransomware attacks.
Click to expand...

Researchers believe that DEV-0569 is an initial access broker that uses its malware distribution system to breach corporate networks. They use this access in their own attacks or sell it to other malicious actors, such as the Royal ransomware gang.

While Microsoft did not share many URLs related to these attacks, further reports from TheFIR and eSentire added more information, including the following URLs used in BatLoader’s campaigns: [...]
Click to expand...

Fast forward to January 21st, 2023, when CronUp researcher Germán Fernández noted that recent Google ads promoting popular software led to malicious sites utilizing infrastructure operated by the DEV-0569 threat actors.

While malicious installers in this campaign no longer use BatLoader, like the previous campaigns seen by Microsoft, they install an information-stealer (RedLine Stealer) and then a malware downloader (Gozi/Ursnif).
In the current campaign, RedLine is used to steal data, such as passwords, cookies, and cryptocurrency wallets, while Gozi/Ursnif is used to download further malware.
Click to expand...

Fernández also accessed DEV-0569's web panel used to track their malware distribution campaign and shared screenshots on Twitter. These screenshots showed the legitimate programs being impersonated and the numerous victims worldwide that were infected daily.
Click to expand...

Log in or Sign up

Emerging Threat Actor DEV-0569 finds new ways to deliver Royal ransomware, various payloads

guest Guest

guest Guest

Log in or Sign up

Emerging Threat Actor DEV-0569 finds new ways to deliver Royal ransomware, various payloads

guest Guest

guest Guest

Useful Searches