Thursday , June 5 2025
coding

EXCLUSIVE
Analysis of 3 Ransomware Threats Active Right Now

Three emerging threats will be discussed below, along with how sandbox analysis can be utilized to detect them proactively.

Lockbit Ransomware:

CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed

IBM has issued a security advisory for vulnerabilities in its QRadar Suite Software and Cloud Pak for Security platforms. These...
Read More
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed

ALERT
Thousands of IP addresses compromised nationwide: CIRT warn

As Bangladesh prepares for the extended Eid-ul-Adha holidays, the BGD e-GOV Computer Incident Response Team (CIRT) has issued an urgent...
Read More
ALERT  Thousands of IP addresses compromised nationwide: CIRT warn

New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

In March 2025, the Threatfabric mobile Threat Intelligence team identified Crocodilus, a new Android banking Trojan designed for device takeover....
Read More
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Qualcomm has issued security patches for three zero-day vulnerabilities in the Adreno GPU driver, affecting many chipsets that are being...
Read More
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Critical RCE Flaw Patched in Roundcube Webmail

Roundcube Webmail has fixed a critical security flaw that could enable remote code execution after authentication. Disclosed by security researcher...
Read More
Critical RCE Flaw Patched in Roundcube Webmail

Hacker claim Leak of Deloitte Source Code & GitHub Credentials

A hacker known as "303" claim to breach the company's systems and leaked sensitive internal data on a dark web...
Read More
Hacker claim Leak of Deloitte Source Code & GitHub Credentials

CISA Issued Guidance for SIEM and SOAR Implementation

CISA and ACSC issued new guidance this week on how to procure, implement, and maintain SIEM and SOAR platforms. SIEM...
Read More
CISA Issued Guidance for SIEM and SOAR Implementation

Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

The Qualys Threat Research Unit (TRU) found two local information-disclosure vulnerabilities in Apport and systemd-coredump. Both issues are race-condition vulnerabilities....
Read More
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

Australia enacts mandatory ransomware payment reporting

New ransomware payment reporting rules take effect in Australia yesterday (May 30) for all organisations with an annual turnover of...
Read More
Australia enacts mandatory ransomware payment reporting

Why Govt Demands Foreign CCTV Firms to Submit Source Code?

Global makers of surveillance gear have clashed with Indian regulators in recent weeks over contentious new security rules that require...
Read More
Why Govt Demands Foreign CCTV Firms to Submit Source Code?

The Lockbit ransomware is a major cybersecurity threat that appeared in 2019. It works as Ransomware-as-a-Service (RaaS), where affiliates use its software to carry out attacks. The Royal Mail was one of its main targets, and the attackers demanded an exceptionally high ransom of $80 million.

Lockbit ransomware uses the AES encryption algorithm to encrypt files, and then it encrypts the AES key using the RSA algorithm. This double encryption makes it very difficult for victims to recover their data without the decryption key.

The Lockbit ransomware has consistently evolved, with the most recent version being Lockbit v3, also known as Lockbit Black.

Despite a coalition of law enforcement agencies dismantling its infrastructure in early 2024, Lockbit has now resumed its operations.

Detecting and Analyzing LockBit Black Ransomware in a Sandbox:

Lockbit Ransomware:The Lockbit ransomware is a major cybersecurity threat that appeared in 2019. It works as Ransomware-as-a-Service (RaaS), where affiliates use its software to carry out attacks. The Royal Mail was one of its main targets, and the attackers demanded an exceptionally high ransom of $80 million. Lockbit ransomware uses the AES encryption algorithm to encrypt files, and then it encrypts the AES key using the RSA algorithm. This double encryption makes it very difficult for victims to recover their data without the decryption key. Before encrypting the data, the malware steals all the information from the infected computers, increasing the extortion. The Lockbit group has a website where they list their victims. They pressure companies to pay a ransom. If the victims refuse, their stolen data is published. The Lockbit ransomware has consistently evolved, with the most recent version being Lockbit v3, also known as Lockbit Black. Despite a coalition of law enforcement agencies dismantling its infrastructure in early 2024, Lockbit has now resumed its operations. A recent attack involved sending phishing emails using the Phorpiex botnet. The malware was hidden in the email attachments. Detecting and Analyzing LockBit Black Ransomware in a Sandbox: To avoid a LockBit infection, we can proactively analyze all suspicious files, including email attachments, in a sandbox. As part of the analysis, we can observe: CMSTMLUA process that performs privilege escalation, allowing the ransomware to gain higher-level access to the system. The desktop wallpaper change is a common tactic ransomware operators use to notify victims of compromised systems. A ransom note file containing instructions and Tor URLs for communicating with the attackers. The sandbox provides a conclusive verdict, classifying the analyzed file as exhibiting malicious activity.
Analysis of the LockBit 3.0 ransomware in the ANY.RUN sandbox

To avoid a LockBit infection, we can proactively analyze all suspicious files, including email attachments, in a sandbox.

As part of the analysis, we can observe:

  • CMSTMLUA process that performs privilege escalation, allowing the ransomware to gain higher-level access to the system.
    The desktop wallpaper change is a common tactic ransomware operators use to notify victims of compromised systems.
    A ransom note file containing instructions and Tor URLs for communicating with the attackers.

The sandbox provides a conclusive verdict, classifying the analyzed file as exhibiting malicious activity.

Bluesky Ransomware:

The BlueSky ransomware, detected in Q2 of 2022, is still a major cybersecurity threat. It targets the Windows multithreading architecture to encrypt files faster. This harmful software uses advanced encryption techniques with the ChaCha20 algorithm. It can also spread to other devices on the same network.

After encrypting the files, the ransomware changes their names by adding the .bluesky extension. It also creates a ransom instruction file, instructing victims to pay a ransom by accessing a page on Tor.

Detecting and Analyzing BlueSky Ransomware in a Sandbox:

Despite BlueSky’s anti-analysis functionality, we can easily expose it by uploading its sample to a free malware sandbox like ANY.RUN, which offers a safe virtual environment for detonating it.

See this analysis session for more details.

Analysis of the Bluesky ransomware in the ANY.RUN sandbox

Analysis of the Bluesky ransomware in the ANY.RUN sandbox:

The service instantly detects the malware and notifies us about its presence by adding the corresponding tags “bluesky” and “ransomware”. It also lists the activities carried out by the program including:

File renaming.

Creation and dropping of a ransom note containing instructions on how to decrypt the locked files. Thanks to its interactivity, the sandbox lets us open this note manually and read its contents.

Analysis also reveals that the note contains a TOR network URL, which the victim is instructed to visit to make the ransom payment.

After analysis is complete, we receive a detailed report with all the important information gathered during the file execution, including indicators of compromise.

Beast Ransomware:

Beast ransomware, also known as Monster ransomware, emerged in March 2022. It is built on the Delphi programming language and has the ability to attack both Windows and Linux systems.

The malware doesn’t affect users in CIS countries, indicating that the creators might be from that region. The Beast ransomware uses a high-level encryption method and also archives the encrypted files.

The malware is mainly spread through email attachments and links, taking advantage of people’s vulnerability to phishing attacks. Despite being a new type of ransomware, Beast has the potential to become a serious and widespread threat, similar to LockBit.

Detecting and Analyzing Beast Ransomware in a Sandbox:

By running suspicious files and URLs in a sandbox, we can easily expose Beast and other malware.

Analysis of the Beast ransomware in ANY.RUN sandbox

Consider this analysis session.

Some of the Beast activities detected by the service include:

Installation of a mutex characteristic of the Beast malware.
Attempt to obtain the host’s IP address.
Connection to an external SMB server.

Analyze Suspicious Files and URLs in ANY.RUN

ANY.RUN sandbox allows you to interactively analyze malware. You can safely engage with files and links in a virtual environment to investigate the full extent of each threat.

The service finds and lists all activities in network traffic, registry, file system, and processes, and extracts signs of compromise.

Source: cybersecuritynews.com

Check Also

Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI

Bank Rakyat Indonesia (BRI), the largest state bank by assets, has assured customers that their …

Leave a Reply

Your email address will not be published. Required fields are marked *