These ransomware attackers sent their ransom note to the victim’s printer

May 13, 2022 TH Author

An hacking group which conducts cyber espionage campaigns and ransomware attacks is targeting organisations in Europe and the United States.

Cybersecurity researchers at Secureworks have detailed a string of cyber attacks involving ransomware and data theft which took place in early 2022 to an Iranian hacking group they refer to as Cobalt Mirage – also known as APT35, Charming Kitten, Phosphorus and TA453 by other research groups.

Among the attacks is an incident targeting a US local government network in March 2022, which Secureworks researchers have attributed to Cobalt Mirage due to hallmarks of previously uncovered attacks by the group.

These include exploiting the ProxyShell vulnerabilities to deploy Fast Reverse Proxy client (FRPC) and enable remote access to vulnerable systems, along with use of infrastructure that matches patterns associated with the threat group.

While the initial means of compromise in this attack is still unclear, researchers note how the attackers likely exploited unpatched Log4j vulnerabilities despite a patch being available. There’s evidence that this initial exploitation may have occurred as early as January 2022.

Most of the intrusion activity spanned a four-day period in March, with the key aim of the activity based around scanning the network and stealing data – researchers note that this is strange, as like other attacks detected during the period, the targets had no strategic or political value to Iran.

SEE: A winning strategy for cybersecurity (ZDNet special report)

After the March 2022 intrusion was detected and disrupted, no further malicious activity was observed.

Researchers suggest that the main motivation behind this attack, and others is financial gain, but it’s unclear how exactly the attackers would look to profit from it.

“While the threat actors appear to have had a reasonable level of success gaining initial access to a wide range of targets, their ability to capitalize on that access for financial gain or intelligence collection appears limited,” Secureworks Counter Threat Unit (CTU) researchers wrote in a blog post.

No ransomware was deployed in the attack against the undisclosed US local government victim, but researchers note that Cobalt Mirage does engage in ransomware attacks – as another victim discovered in January described as a ‘a U.S. philanthropic organization’.

According to Secureworks researchers who investigated the incident, attackers used ProxyShell and Microsoft Exhange vulnerabilities to move around the network and remotely gain access to accounts, before eventually triggering a BitLocker ransomware attack.

Unusually, the ransom note was sent to a printer on the network and printed out on paper, detailing an email address and contact details. While Cobalt Mirage has links to state-backed hacking operations, in this case, the ransomware is being deployed as a purely financially motivated attack. Ransomware ransom notes are more typically left either on screens or on servers.

“The threat actors completed the attack with an unusual tactic of sending a ransom note to a local printer. The note includes a contact email address and Telegram account to discuss decryption and recovery. This approach suggests a small operation that relies on manual processes to map victims to the encryption keys used to lock their data,” the security researchers said.

In both incidents detailed by researchers, attackers were able to gain access to networks by exploiting unpatched critical cybersecurity vulnerabilities. In order to protect networks against cyber attacks, it’s recommended that security patches are applied as quickly as possible in order to prevent potential intruders exploiting known vulnerabilities.

Researchers also recommend implementing multi-factor authentication, and monitoring for unauthorised or suspicious use of tools and file-sharing services which could indicate attackers are in the network.

MORE ON CYBERSECURITY