{"id":15833,"date":"2019-07-18T11:10:09","date_gmt":"2019-07-18T19:10:09","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/07\/18\/news-9580\/"},"modified":"2019-07-18T11:10:09","modified_gmt":"2019-07-18T19:10:09","slug":"news-9580","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/07\/18\/news-9580\/","title":{"rendered":"Threat Spotlight: Sodinokibi ransomware attempts to fill GandCrab void"},"content":{"rendered":"

Credit to Author: Jovi Umawing| Date: Thu, 18 Jul 2019 17:58:26 +0000<\/strong><\/p>\n

Sodinokibi, also known as Sodin and REvil, is hardly six months old, yet it has quickly become a topic of discussion among cybersecurity professionals because of its apparent connection with the infamous-but-now-defunct GandCrab<\/a> ransomware.<\/p>\n

On May 31, the threat actors behind GandCrab formally announced their retirement, detailing their plan to cease selling and advertising GandCrab in a dark web forum post.<\/p>\n

\"\"
\u201cWe are leaving for a well-deserved retirement,\u201d a GandCrab RaaS administrator announced. (Courtesy of security researcher Damian<\/a> on Twitter) <\/figcaption><\/figure>\n

While many may have heaved sighs of relief, some expressed skepticism<\/a> over whether the GandCrab team would truly put behind their widely successful money-making scheme. What followed was bleak anticipation of another ransomware operation\u2014or a re-emergence of the group peddling new wares\u2014taking over to fill the hole GandCrab left behind. <\/p>\n

In a way, they were all right.<\/p>\n

Enter Sodinokibi<\/h3>\n

Putting a spin on an old product is a concept not unheard of in legitimate business circles. Often, spinning involves creating a new name for the product, some tweaking on its existing features, and finding new influencers\u2014”affiliates” in the case of ransomware-as-a-service<\/a> operations\u2014to use (and market) the product. In addition, threat actors would initially limit the new product\u2019s availability and follow with a brand-new marketing campaign\u2014all without touching the product standard. In hindsight, it seems the GandCrab team has taken this route.<\/p>\n

A month before the GandCrab retirement announcement, Cisco Talos researchers released<\/a> information about a new ransomware called Sodinokibi. Attackers manually infected the target server after exploiting a zero-day vulnerability<\/a> in its Oracle WebLogic application.<\/p>\n

To date, six versions of Sodinokibi has been seen in the wild.<\/p>\n

\"\"
Sodinokibi versions, from the earliest (v1.0a), which was discovered on April 23, to the latest (v1.3), which was discovered July 8. <\/figcaption><\/figure>\n

Based on our telemetry, Sodinokibi has spread wide to both businesses and consumers since GandCrab\u2019s exit.<\/p>\n

\"\"
Business and consumer detection trends for Sodin\/REvil, which Malwarebytes detects as Ransom.Sodinokibi<\/a>. <\/figcaption><\/figure>\n

Sodinokibi infection vectors <\/h3>\n

Like GandCrab, the Sodinokibi ransomware-as-a-service (RaaS) follows an affiliate revenue system, which allows other cybercriminals to spread it through several vectors:<\/p>\n