LockBit 2.0 Ransomware

Original Issue Date:- February 22, 2022

Virus Type:-Ransomware

Severity:- Critical

It has been reported that the LockBit 2.0 ransomware, which operates as an affiliate-based Ransomware-as-a-Service (RaaS) ramped up its targeted attacks.

Infection Mechanism

LockBit 2.0 is spreading through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits. LockBit 2.0 also developed a Linux-based malware that takes advantage of vulnerabilities within VMWare ESXi virtual machines.

It is also reported that LockBit threat actors are actively exploiting existing vulnerabilities in the Fortinet FortiOS and FortiProxy products, identified as CVE-2018-13379, in order to gain initial access to specific victim networks. After compromising a victim network, LockBit 2.0 actors use publicly available tools such as Mimikatz to escalate privileges. LockBit 2.0 also abuses legitimate tools such as Process Hacker and PC Hunter to terminate processes and services in the victim system.

Prior to encryption, LockBit affiliates primarily use the Stealbit application obtained directly from the LockBit panel to exfiltrate specific file types. LockBit 2.0 features automatic encryption of devices across windows domains by abusing Active Directory group policies. The actor leaves a ransom note in each affected directory within victim systems, which provides instructions on how to obtain the decryption software.

Fig.1 Ransom Note

The following are the tools and components that ensure LockBit’s smooth execution:

delsvc.bat ensures that crucial processes, such as MySQL and QuickBooks, are unavailable. It also stops Microsoft Exchange and disables other related services.

AV.bat uninstalls the antivirus program ESET.

LogDelete.bat clears Windows Event Logs.

Defoff.bat disables Windows Defender features such as real-time monitoring.

The malware comes with a hidden debug window that can be activated during the infection process using the SHIFT + F1 keyboard shortcut.

Fig.2 Screen Capture of Hidden Window

Indicator of Compromise:

IP Addresses

139.60.160.200
93.190.139.223
45.227.255.190
193.162.143.218
168.100.11.72
93.190.143.101
88.80.147.102
193.38.235.234
174.138.62.35
185.215.113.39
185.182.193.120

Hashes (SHA 256)

0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049
0906a0b27f59b6db2a2451a0e0aabf292818e32ddd5404d08bf49c601a466744
21879b5a8a84c5fe5e009c85744caf74b817c57203020bf919037d7ccb6b6a58
255f8465962bedaf7a373da5f721aecbc1d6027ca2e4256c6c4352f2de179ca0
4db47caf8d93e855b8364def67d3d3282fc964dc4684df6bbe172ea6e902e6fe
7b64ca8fe1cace0744a28f43961f17f8ea51910a54d6629502bfb9f3f3e5f831
8c0e4a6fd28f94fa17a96f6e424b122f5d1216b230a33c6dff5dbf6654d0721c
a05ed65787b390ba33b04b4b99c3810cbaf684b37f8839e57db8316e6f01af31
a26250b8d2431b497400c8a754285a6259a81a31ae629ee25331f6030b34e543
b09a92dedbcb8d5faed6fcc2194ebaa24da601376b47e1edf705519a7860964e
bea7aed0dfbf7ce7491d7c8cfed35a2e626fbd345bb7425a34dae6f5894629b1
cb29c6fbd085407e0e8a58e7cd6512c8c5dfa06f88fdeeb9a66d025fdfc6dd32
f03584ecdee29e63dee1b7bf2347f605d1e1d6379a8f55e9a85c6a329bf3967b
28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d
4bb152c96ba9e25f293bbc03c607918a4452231087053a8cb1a8accb1acc92fd
4edbf2358a9820e030136dc76126c20cc38159df0d8d7b13d30b1c9351e8b277
bcbb1e388759eea5c1fbb4f35c29b6f66f3f4ca4c715bab35c8fc56dcf3fa621
dd8fe3966ab4d2d6215c63b3ac7abf4673d9c19f2d9f35a6bf247922c642ec2d
4db7eeed852946803c16373a085c1bb5f79b60d2122d6fc9a2703714cdd9dac0
6876eef67648a3797987745617b9fdfb31a703b7809e7f12bb52c6386e185917
717585e9605ac2a971b7c7537e6e311bab9db02ecc6451e0efada9b2ff38b474
73406e0e7882addf0f810d3bc0e386fd5fd2dd441c895095f4125bb236ae7345
7b5db447f6c29c939f5e0aae1b16431a132db5a2ab4420ba9818af2bf4496d21
aae5e59d6424515c157f3c4a54e4feeb09759d028290ab0271f730e82f58f10f
94e6b969c100483970fc3985bf2b173f2f24d796a079114f584f42484840be28
a398c70a2b3bf8ae8b5ceddf53fcf6daa2b68af2fadb76a8ea6e33b8bbe06f65
98e4c248377b5b62121c7b9ef20fc03df3473cbd886a059998f4210e8df07f15
a7591e4a248c04547579f014c94d7d30aa16a01bb2a25b77df36e30a198df108
acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c
b3faf5d8cbc3c75d4c3897851fdaf8d7a4bd774966b4c25e0e4617546109aed5
bd14872dd9fdead89fc074fdc5832caea4ceac02983ec41f814278130b3f943e
d089d57b8b2b32ee9816338e96680127babc5d08a03150740a8459c29ab3ba78
d089d57b8b2b32ee9816338e96680127babc5d08a03150740a8459c29ab3ba78
f32e9fb8b1ea73f0a71f3edaebb7f2b242e72d2a4826d6b2744ad3d830671202
f3a1576837ed56bcf79ff486aadf36e78d624853e9409ec1823a6f46fd0143ea
67df6effa1d1d0690c0a7580598f6d05057c99014fcbfe9c225faae59b9a3224
ee3e03f4510a1a325a06a17060a89da7ae5f9b805e4fe3a8c78327b9ecae84df

Best Practices and Recommendations to protect users against the threat of ransomware:

Users and administrators are advised to take the following preventive measures to protect their computer networks from ransomware infection/ attacks:

Maintain offline backups of data, and regularly maintain backup and restoration. This practice will ensure the organization will not be severely interrupted, have irretrievable data.
Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted) and covers the entire organization’s data infrastructure
Implement all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts) to have strong, unique passwords.
Implement multi-factor authentication for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.
Remove unnecessary access to administrative shares
Use a host-based firewall to only allow connections to administrative shares via server message block (SMB) from a limited set of administrator machines
Enable protected files in the Windows Operating System to prevent unauthorized changes to critical files
Disable remote Desktop Connections, employ least-privileged accounts. Limit users who can log in using Remote Desktop, set an account lockout policy. Ensure proper RDP logging and configuration
Check regularly for the integrity of the information stored in the databases
Ensure integrity of the codes /scripts being used in database, authentication and sensitive system
Establish Domain-based Message Authentication, Reporting, and Conformance (DMARC), Domain Keys Identified Mail (DKIM) and Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches
Application white listing/Strict implementation of Software Restriction Policies (SRP)to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
Maintain updated Antivirus software on all systems
Don't open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization's website directly through browser
Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
Restrict access using firewalls and allow only to selected remote endpoints, VPN may also be used with dedicated pool for RDP access
Use strong authentication protocol, such as Network Level Authentication (NLA) in Windows.
Additional Security measures that may be considered are

Use RDP Gateways for better management
Change the listening port for Remote Desktop
Tunnel Remote Desktop connections through IPSec or SSH
Two-factor authentication may also be considered for highly critical systems

If not required consider disabling, PowerShell / windows script hosting.
Restrict users' abilities (permissions) to install and run unwanted software applications.
Enable personal firewalls on workstations.
Implement strict External Device (USB drive) usage policy.
Employ data-at-rest and data-in-transit encryption.
Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empanelled auditors. Repeat audits at regular intervals.
Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies

References: