Unfamiliar Yanluowang ransomware used in highly targeted attacks on huge orgs

Written by

Researchers spotted a new strain of ransomware, dubbed Yanluowang, that was used in highly targeted attacks against enterprises.

Researchers from Symantec Threat Hunter Team discovered a ransomware family, tracked as Yanluowang ransomware that was used in highly targeted attacks against huge enterprises.

The discovery is part of an investigation into a recent attempted ransomware flak against a large organization.

“The Threat Hunter Team unusual spotted suspicious use of AdFind, a legitimate command-line Active Directory query tool, on the victim organization’s network. This tool is often abused by ransomware attackers as a reconnaissance tool, as well as to equip the attackers with the resources that they need for lateral movement via Robust Directory.” reads the analysis published by Symantec. “Just days after the suspicious AdFind activity was observed on the victim organization, the attackers attempted to deploy the Yanluowang ransomware.”

The researchers noticed the use of the legitimate AdFind command line Active Directory query tool that is often abused by ransomware operators as a reconnaissance tool.

Before being deployed on compromised devices, the attackers launch a malicious tool designed to prepare the environs with the following actions:

  • Creates a .txt file with the number of remote machines to check in the command line
  • Uses Windows Management Instrumentation (WMI) to get a list of processes running on the remote machines listed in the .txt file
  • Logs all the processes and remote machine names to processes.txt

The analysis of the samples collected by the experts revealed that the Yanluowang ransomware uses the Windows API for encryption.

Upon deploying the Yanluowang ransomware, it will stop hypervisor virtual machines, End all processes logged by the above tool (including SQL and back-up solution Veeam), then it will encrypt files. The ransomware appends the .yanluowang continuation to the filenames of the encrypted files.

The ransom note (README.txt) dropped on the infected machine warns the victims not to contact law enforcement or ask ransomware negotiation firms for help. The ransomware operators will launch distributed denial of service (DDoS) attacks against the victim if it will not estimate their rules. The ransomware operators also threaten to make calls to employees and business partners to harm the brand reputation of the victims, along with targeting again the victim in a few weeks and delete its data.

Yanluowang ransom note
Yanluowang ransom note: Source Symantec Threat Huntsman Team

The report published by Symantec also includes Indicators of compromise (IoCs).

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, cyber security)

The post Recently created Yanluowang ransomware used in highly targeted attacks on large orgs appeared unusual on Security Affairs.

Article Categories:
cybercrime · hacking · Malware · Ransomware

Comments are closed.

Shares