Ransomware: Now gangs are using virtual machines to disguise their attacks

guest · Jun 24, 2021

Ransomware: Now gangs are using virtual machines to disguise their attacks
Ransomware operators are using virtual machines to avoid their unusual network activity
June 24, 2021
https://www.zdnet.com/article/ranso...machines-to-hide-attacks-from-being-detected/

Cyber criminals are increasingly using virtual machines to compromise networks with ransomware.

By using virtual machines as part of the process, ransomware attackers are able to conduct their activity with additional subtlety, because running the payload within a virtual environment reduces the chances of the activity being discovered – until it's too late and the ransomware has encrypted files on the host machine.
Click to expand...

During a recent investigation into an attempted ransomware attack, cybersecurity researchers at Symantec found the ransomware operations had been using VirtualBox – a legitimate form of open-source virtual machine software – to run instances of Windows 7 to aid the installation of ransomware.

"The motivation behind the tactic is stealth. In order to avoid raising suspicions or triggering antivirus software, the ransomware payload will "hide" within a VM while encrypting files on the host computer," Symantec said.
Click to expand...

"Groups will often mimic others' tactics if they think they've been successful. There may be a belief that some security solutions cannot reliably and consistently detect the ransomware sample executing from inside a virtual machine (VM)," said Dick O'Brien, principal in the Symantec Threat Hunter Team.
Click to expand...

Symantec: Ransomware: Growing Number of Attackers Using Virtual Machines

The tactic is a recent development, having been documented by Sophos in connection with RagnarLocker last year. In that case, ransomware was run from inside an Oracle VirtualBox Windows XP VM.
Conti or Mount Locker?
While the payload running in the VM was not identified, there were reasonably strong indicators that it was Conti.

However, on the same computer that the VM was deployed on, Symantec also observed Mount Locker being deployed, raising the question as to whether the payload was actually Mount Locker.
Click to expand...

One possible explanation is that the attacker is an affiliate operator with access to both Conti and Mount Locker. They may have attempted to run a payload (either Conti or Mount Locker) on a virtual machine and, when that didn’t work, opted to run Mount Locker on the host computer instead.
Click to expand...

Log in or Sign up

Ransomware: Now gangs are using virtual machines to disguise their attacks

guest Guest

Log in or Sign up

Ransomware: Now gangs are using virtual machines to disguise their attacks

guest Guest

Useful Searches