LockerGoga, MegaCortex Ransomware Share Unlikely Traits

New form of ransomware MegaCortex shares commonalities with LockerGoga, enterprise malware recently seen in major cyberattacks.

MegaCortex, a newly discovered form of ransomware that targets global organizations, was found to share similarities with LockerGoga, a known form of malware seen in enterprise attacks.
Sophos researchers published initial findings related to MegaCortex late last week. The active ransomware variant sends victims a note designed to read as if its from Morpheus, Laurence Fishburnes character in
The Matrix
. MegaCortex was spotted hitting several enterprise customers across the US, Europe, and Canada, with 47 attack attempts within a 48-hour period.
A few traits of MegaCortex made the campaign stand out. Victims reported the attacks originated from a compromised domain controller, and adversaries used stolen admin credentials to run a PowerShell script using the compromised controller — both traits that make it unique,
says
Jessica Bair, senior manager of advanced threat solutions at Cisco Systems.
Researchers note this ransomware is mostly seen among businesses with existing Emotet and Qbot infections, both of which can be used as launching points to distribute other malware. Given this, organizations previously exposed to either threat should prioritize remediation.
In the week since its early findings were disclosed, the Sophos team has become aware of more attacks involving MegaCortex and updated their research to reflect additional data on the tools, techniques, and other specifics that were not known at the time of publication.
Since last week we have learned a lot more of the small details about the behavior and tooling used by MegaCortex, says Chet Wisniewski, Sophos principal research scientist. Many of these details are similar or identical to another ransomware named LockerGoga, however, there isnt much code similarity between them. Still, there are a few interesting similarities:
Links to LockerGoga
LockerGoga is a form of ransomware recently used in a major cyberattack against Norwegian aluminum firm Norsk Hydro, where it
disrupted
critical operations across North America and Europe. The incident forced Norsk Hydro to transition to manual operations at multiple plants; so far, it has cost the manufacturer $40 million. Once on a system, LockerGoga, which appears to be designed for targeted campaigns, changes passwords and forcibly logs victims out of systems.
The two forms of ransomware appear to behave the same way, Wisniewski explains. In both, operators leverage a compromised domain controller to push malware out to machines on a target network. From there, they open a reverse shell from the internal network to one of their command-and-control (C2) servers to execute the attacks. At least one of the C2 addresses that MegaCortex contacts has also been used by LockerGoga, researchers explain
in a blog post
.
MegaCortex also renames the files it plans to encrypt before encrypting them, which is unusual for ransomware — except LockerGoga, which does the same. We suspect this may be used to prevent the malware from unintentionally encrypting files twice on an infected machine, says Wisniewski. The tactic has another effect: it makes those renamed files un-double-clickable as it removes the file type association of the document with its parent application.
One of the most obvious similarities is the batch file used in the attack, Wisniewski continues. Many researchers think its virtually identical to batch files used to kill processes during LockerGoga attacks. Still, he says, none of the individual similarities are enough to make any attribution to MegaCortexs origin. At this time, they remain a large number of interesting coincidences.
Contemplating Cryptographic Certificates
MegaCortex uses signed binaries with the common name (CN) mimicking the same CN used in the signed binaries of completely unrelated malware families. For example, researchers queried a CN on the cryptographic certificate used to sign one of the MegaCortex malware executables. They found malware from Rietspoof, a financial-services credential stealer with no code similarity or link to MegaCortex.
Were not sure why they would do this, says Wisniewski. Often things are thrown in to confuse those investigating the attacks, a sort of false flag operation. The certificates for MegaCortex were issued by different authorities from the certificates they were mimicking; for example, that of Rietspoof. Some certificate authorities are now revoking the certificates used in MegaCortex attacks, Wisniewski says.
Investigation into certificates yielded another interesting finding: researchers noticed the address used by the certificate — a street address located in London suburb Romford — is connected to more than 74,000 registered UK businesses. There is also evidence the same address has been used in signing certificates that were then used to sign unrelated malware binaries. Theyre still looking into this.
We do not really understand how an apparent residential address ended up being used as a business address for some 74,000+ companies currently or formerly registered in the UK, says Wisniewski, who adds that site for The Companies House — the United Kingdoms registrar for companies — permits visitors to access only the first 1,000 records of this search.
Related Content:
Demystifying the Dark Web: What You Need to Know
Attacks on JavaScript Services Leak Info From Websites
Hackers Still Outpace Breach Detection, Containment Efforts
Data Dump Purportedly Reveals Details on Previously Unknown Iranian Threat Group

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industrys most knowledgeable IT security experts. Check out the
Interop agenda
here.

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
LockerGoga, MegaCortex Ransomware Share Unlikely Traits