New ransomware actor uses password-protected archives to bypass encryption protection

guest · Nov 18, 2021

New Memento ransomware switches to WinRar after failing at encryption
November 18, 2021
https://www.bleepingcomputer.com/ne...itches-to-winrar-after-failing-at-encryption/

A new ransomware group called Memento takes the unusual approach of locking files inside password-protected archives after their encryption method kept being detected by security software.

Last month, the group became active when they began exploiting a VMware vCenter Server web client flaw for the initial access to victims' networks.
The vCenter vulnerability is tracked as 'CVE-2021-21971' and is an unauthenticated, remote code execution bug with a 9.8 (critical) severity rating.
Click to expand...

After the reconnaissance stage, the actors used WinRAR to create an archive of the stolen files and exfiltrate it.
Finally, they used Jetico’s BCWipe data wiping utility to delete any traces left behind and then used a Python-based ransomware strain for the AES encryption.

However, Memento's original attempts at encrypted files as the systems had anti-ransomware protection, causing the encryption step to be detected and stopped before any damage was done.
Click to expand...

A workaround
To overcome the detection of commodity ransomware by security software, Memento came up with an interesting tactic - skip encryption altogether and move files into password-protected archives.

To do this, the group now moves files into WinRAR archives, sets a srong password for access protection, encrypts that key, and finally deletes the original files.

"Instead of encrypting files, the “crypt” code now put the files in unencrypted form into archive files, using the copy of WinRAR, saving each file in its own archive with a .vaultz file extension," explains Sophos analyst Sean Gallagher.
Click to expand...

Sophos: New ransomware actor uses password-protected archives to bypass encryption protection

Calling themselves "Memento team", actors use Python-based ransomware that they reconfigured after setbacks.
In late October, Sophos MTR’s Rapid Response Team encountered a new ransomware group with an interesting approach to holding victims’ files hostage. The ransomware used by this group, who identify themselves as “Memento Team,” doesn’t encrypt files. Instead, it copies files into password-protected archives, using a renamed freeware version of the legitimate file utility WinRAR—and then encrypts the password and deletes the original files.

This was a retooling by the ransomware actors, who initially attempted to encrypt files directly—but were stopped by endpoint protection.
Click to expand...

Log in or Sign up

New ransomware actor uses password-protected archives to bypass encryption protection

guest Guest

Log in or Sign up

New ransomware actor uses password-protected archives to bypass encryption protection

guest Guest

Useful Searches