Wednesday , June 25 2025
coding

EXCLUSIVE
Analysis of 3 Ransomware Threats Active Right Now

Three emerging threats will be discussed below, along with how sandbox analysis can be utilized to detect them proactively.

Lockbit Ransomware:

WhatsApp banned on all US House of Representatives devices

The U.S. House of Representatives has banned congressional staff from using WhatsApp on government devices due to security concerns, as...
Read More
WhatsApp banned on all US House of Representatives devices

Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store

Kaspersky found a new mobile malware dubbed SparkKitty in Google Play and Apple App Store apps, targeting Android and iOS....
Read More
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store

OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems

OWASP has released its AI Testing Guide, a framework to help organizations find and fix vulnerabilities specific to AI systems....
Read More
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems

Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform

In a major milestone for the country’s digital infrastructure, Axentec PLC has officially launched Axentec Cloud, Bangladesh’s first Tier-4 cloud...
Read More
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform

Hackers Bypass Gmail MFA With App-Specific Password Reuse

A hacking group reportedly linked to Russian government has been discovered using a new phishing method that bypasses two-factor authentication...
Read More
Hackers Bypass Gmail MFA With App-Specific Password Reuse

Russia detects first SuperCard malware attacks via NFC

Russian cybersecurity experts discovered the first local data theft attacks using a modified version of legitimate near field communication (NFC)...
Read More
Russia detects first SuperCard malware attacks via NFC

Income Property Investments exposes 170,000+ Individuals record

Cybersecurity researcher Jeremiah Fowler discovered an unsecured database with 170,360 records belonging to a real estate company. It contained personal...
Read More
Income Property Investments exposes 170,000+ Individuals record

ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs

GreyNoise found attempts to exploit CVE-2023-28771, a vulnerability in Zyxel's IKE affecting UDP port 500. The attack centers around CVE-2023-28771,...
Read More
ALERT (CVE: 2023-28771)  Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs

CISA Flags Active Exploits in Apple iOS and TP-Link Routers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently included two high-risk vulnerabilities in its Known Exploited Vulnerabilities (KEV)...
Read More
CISA Flags Active Exploits in Apple iOS and TP-Link Routers

10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online

SafetyDetectives’ Cybersecurity Team discovered a public post on a clear web forum in which a threat actor claimed to have...
Read More
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online

The Lockbit ransomware is a major cybersecurity threat that appeared in 2019. It works as Ransomware-as-a-Service (RaaS), where affiliates use its software to carry out attacks. The Royal Mail was one of its main targets, and the attackers demanded an exceptionally high ransom of $80 million.

Lockbit ransomware uses the AES encryption algorithm to encrypt files, and then it encrypts the AES key using the RSA algorithm. This double encryption makes it very difficult for victims to recover their data without the decryption key.

The Lockbit ransomware has consistently evolved, with the most recent version being Lockbit v3, also known as Lockbit Black.

Despite a coalition of law enforcement agencies dismantling its infrastructure in early 2024, Lockbit has now resumed its operations.

Detecting and Analyzing LockBit Black Ransomware in a Sandbox:

Lockbit Ransomware:The Lockbit ransomware is a major cybersecurity threat that appeared in 2019. It works as Ransomware-as-a-Service (RaaS), where affiliates use its software to carry out attacks. The Royal Mail was one of its main targets, and the attackers demanded an exceptionally high ransom of $80 million. Lockbit ransomware uses the AES encryption algorithm to encrypt files, and then it encrypts the AES key using the RSA algorithm. This double encryption makes it very difficult for victims to recover their data without the decryption key. Before encrypting the data, the malware steals all the information from the infected computers, increasing the extortion. The Lockbit group has a website where they list their victims. They pressure companies to pay a ransom. If the victims refuse, their stolen data is published. The Lockbit ransomware has consistently evolved, with the most recent version being Lockbit v3, also known as Lockbit Black. Despite a coalition of law enforcement agencies dismantling its infrastructure in early 2024, Lockbit has now resumed its operations. A recent attack involved sending phishing emails using the Phorpiex botnet. The malware was hidden in the email attachments. Detecting and Analyzing LockBit Black Ransomware in a Sandbox: To avoid a LockBit infection, we can proactively analyze all suspicious files, including email attachments, in a sandbox. As part of the analysis, we can observe: CMSTMLUA process that performs privilege escalation, allowing the ransomware to gain higher-level access to the system. The desktop wallpaper change is a common tactic ransomware operators use to notify victims of compromised systems. A ransom note file containing instructions and Tor URLs for communicating with the attackers. The sandbox provides a conclusive verdict, classifying the analyzed file as exhibiting malicious activity.
Analysis of the LockBit 3.0 ransomware in the ANY.RUN sandbox

To avoid a LockBit infection, we can proactively analyze all suspicious files, including email attachments, in a sandbox.

As part of the analysis, we can observe:

  • CMSTMLUA process that performs privilege escalation, allowing the ransomware to gain higher-level access to the system.
    The desktop wallpaper change is a common tactic ransomware operators use to notify victims of compromised systems.
    A ransom note file containing instructions and Tor URLs for communicating with the attackers.

The sandbox provides a conclusive verdict, classifying the analyzed file as exhibiting malicious activity.

Bluesky Ransomware:

The BlueSky ransomware, detected in Q2 of 2022, is still a major cybersecurity threat. It targets the Windows multithreading architecture to encrypt files faster. This harmful software uses advanced encryption techniques with the ChaCha20 algorithm. It can also spread to other devices on the same network.

After encrypting the files, the ransomware changes their names by adding the .bluesky extension. It also creates a ransom instruction file, instructing victims to pay a ransom by accessing a page on Tor.

Detecting and Analyzing BlueSky Ransomware in a Sandbox:

Despite BlueSky’s anti-analysis functionality, we can easily expose it by uploading its sample to a free malware sandbox like ANY.RUN, which offers a safe virtual environment for detonating it.

See this analysis session for more details.

Analysis of the Bluesky ransomware in the ANY.RUN sandbox

Analysis of the Bluesky ransomware in the ANY.RUN sandbox:

The service instantly detects the malware and notifies us about its presence by adding the corresponding tags “bluesky” and “ransomware”. It also lists the activities carried out by the program including:

File renaming.

Creation and dropping of a ransom note containing instructions on how to decrypt the locked files. Thanks to its interactivity, the sandbox lets us open this note manually and read its contents.

Analysis also reveals that the note contains a TOR network URL, which the victim is instructed to visit to make the ransom payment.

After analysis is complete, we receive a detailed report with all the important information gathered during the file execution, including indicators of compromise.

Beast Ransomware:

Beast ransomware, also known as Monster ransomware, emerged in March 2022. It is built on the Delphi programming language and has the ability to attack both Windows and Linux systems.

The malware doesn’t affect users in CIS countries, indicating that the creators might be from that region. The Beast ransomware uses a high-level encryption method and also archives the encrypted files.

The malware is mainly spread through email attachments and links, taking advantage of people’s vulnerability to phishing attacks. Despite being a new type of ransomware, Beast has the potential to become a serious and widespread threat, similar to LockBit.

Detecting and Analyzing Beast Ransomware in a Sandbox:

By running suspicious files and URLs in a sandbox, we can easily expose Beast and other malware.

Analysis of the Beast ransomware in ANY.RUN sandbox

Consider this analysis session.

Some of the Beast activities detected by the service include:

Installation of a mutex characteristic of the Beast malware.
Attempt to obtain the host’s IP address.
Connection to an external SMB server.

Analyze Suspicious Files and URLs in ANY.RUN

ANY.RUN sandbox allows you to interactively analyze malware. You can safely engage with files and links in a virtual environment to investigate the full extent of each threat.

The service finds and lists all activities in network traffic, registry, file system, and processes, and extracts signs of compromise.

Source: cybersecuritynews.com

Check Also

Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI

Bank Rakyat Indonesia (BRI), the largest state bank by assets, has assured customers that their …

Leave a Reply

Your email address will not be published. Required fields are marked *