New Ransomware Variants Flourish Amid Law Enforcement Actions

Ransomware groups continue to evolve their tactics and
techniques to deploy file-encrypting malware on compromised
systems, notwithstanding law enforcement’s disruptive actions
against the cybercrime gangs to prevent them from victimizing
additional companies.

“Be it due to law enforcement, infighting amongst groups or
people abandoning variants altogether, the RaaS
[ransomware-as-a-service] groups dominating the ecosystem at this
point in time are completely different than just a few months ago,”
Intel 471 researchers said^[1]
in a report published this month. “Yet, even with the shift in the
variants, ransomware incidents as a whole are still on the
rise.”

Sweeping law enforcement operations undertaken by government agencies^[2] in recent months have
brought about rapid shifts in the RaaS landscape and turned the
tables on ransomware syndicates like Avaddon, BlackMatter^[3], Cl0p^[4], DarkSide^[5], Egregor, and REvil^[6], forcing the actors to
slow down or shut down their businesses altogether.

But just as these variants are fading into obscurity, other
up-and-coming groups have stepped in to fill the vacuum. Intel
471’s findings have uncovered a total of 612 ransomware attacks
between July to September 2021 that can be attributed to 35
different ransomware variants.

Roughly 60% of the observed infections were tied to four
variants alone — topped by LockBit 2.0 (33%), Conti^[7]
(15.2%), BlackMatter (6.9%), and Hive (6%) — and primarily impacted
manufacturing, consumer and industrial products, professional
services and consulting, and real estate sectors.

Avos Locker^[8]
is one among the many such cartels that have not only witnessed a
surge in attacks, but have also adopted new tactics to pursue their
financially motivated schemes, chief among them being the ability
to disable endpoint security products on the targeted systems and
boot into Windows Safe Mode to execute the ransomware. Also
installed is the AnyDesk remote administration tool to maintain
access to the machine while running in Safe Mode.

“The reason for this is that many, if not most, endpoint
security products do not run in Safe Mode — a special diagnostic
configuration in which Windows disables most third-party drivers
and software, and can render otherwise protected machines unsafe,”
SophosLabs principal security researcher, Andrew Brandt, said^[9]. “The techniques
deployed by Avos Locker are simple yet clever, with attackers
ensuring that the ransomware has the best chance of running in Safe
Mode and allowing the attackers to retain remote access to the
machines throughout the attack.”

Hive’s RaaS program, for its part, has been dubbed “aggressive”
for its use of pressure tactics to make victim organizations pay
ransoms, with Group-IB linking^[10] the strain to attacks
on 355 companies as of October 16 since it emerged on the landscape
in late June 2021. Meanwhile, Russian-language ransomware group
Everest is taking its extortion tactics to the next level by
threatening to sell off access to targeted systems if their demands
aren’t met, NCC Group said.

“While selling ransomware-as-a-service has seen a surge in
popularity over the last year, this is a rare instance of a group
forgoing a request for a ransom and offering access to IT
infrastructure — but we may see copycat attacks in 2022 and
beyond,” the U.K.-based cybersecurity company pointed out^[11].

What’s more, a relatively new ransomware family dubbed Pysa (aka
Mespinoza) has unseated Conti as one of the top ransomware threat
groups for the month of November alongside LockBit 2.0. The
ransomware witnessed a 50% increase in the number of targeted
companies and a 400% spike in attacks against government-sector
systems when compared to the month of October.

“While law enforcement around the world has gotten more
aggressive in their efforts to arrest those behind attacks,
developers are still easily shutting down popular variants, laying
low, and coming back with finely-tuned malware used by themselves
as well as affiliates,” Intel 471 researchers said. “As long as the
developers can remain in countries where they are granted safe
harbor, the attacks will continue, albeit with different
variants.”