A hacktivist group generally known as Twelve has been noticed utilizing an arsenal of publicly out there instruments to conduct damaging cyber assaults in opposition to Russian targets.
“Reasonably than demand a ransom for decrypting knowledge, Twelve prefers to encrypt victims’ knowledge after which destroy their infrastructure with a wiper to stop restoration,” Kaspersky mentioned in a Friday evaluation.
“The strategy is indicative of a need to trigger most injury to focus on organizations with out deriving direct monetary profit.”
The hacking group, believed to have been shaped in April 2023 following the onset of the Russo-Ukrainian warfare, has a observe file of mounting cyber assaults that goal to cripple sufferer networks and disrupt enterprise operations.
It has additionally been noticed conducting hack-and-leak operations that exfiltrate delicate info, which is then shared on its Telegram channel.
Kaspersky mentioned Twelve shares infrastructural and tactical overlaps with a ransomware group known as DARKSTAR (aka COMET or Shadow), elevating the chance that the 2 intrusion units are doubtless associated to 1 one other or a part of the identical exercise cluster.
“On the identical time, whereas Twelve’s actions are clearly hacktivist in nature, DARKSTAR sticks to the traditional double extortion sample,” the Russian cybersecurity vendor mentioned. “This variation of goals throughout the syndicate underscores the complexity and variety of contemporary cyberthreats.”
The assault chains begin with gaining preliminary entry by abusing legitimate native or area accounts, after which the Distant Desktop Protocol (RDP) is used to facilitate lateral motion. A few of these assaults are additionally carried out by way of the sufferer’s contractors.
“To do that, they gained entry to the contractor’s infrastructure after which used its certificates to hook up with its buyer’s VPN,” Kaspersky famous. “Having obtained entry to that, the adversary can connect with the shopper’s methods by way of the Distant Desktop Protocol (RDP) after which penetrate the shopper’s infrastructure.”
Distinguished among the many different instruments utilized by Twelve are Cobalt Strike, Mimikatz, Chisel, BloodHound, PowerView, adPEAS, CrackMapExec, Superior IP Scanner, and PsExec for credential theft, discovery, community mapping, and privilege escalation. The malicious RDP connections to the system are tunneled by means of ngrok.
Additionally deployed are PHP internet shells with capabilities to execute arbitrary instructions, transfer information, or ship emails. These applications, such because the WSO internet shell, are available on GitHub.
In a single incident investigated by Kaspersky, the menace actors are mentioned to have exploited identified safety vulnerabilities (e.g., CVE-2021-21972 and CVE-2021-22005) in VMware vCenter to ship a internet shell that then was used to drop a backdoor dubbed FaceFish.
“To achieve a foothold within the area infrastructure, the adversary used PowerShell so as to add area customers and teams, and to switch ACLs (Entry Management Lists) for Energetic Listing objects,” it mentioned. “To keep away from detection, the attackers disguised their malware and duties beneath the names of present services or products.”
Among the names used embrace “Replace Microsoft,”https://thehackernews.com/2024/09/”Yandex,”https://thehackernews.com/2024/09/”YandexUpdate,” and “intel.exe.”
The assaults are additionally characterised by way of a PowerShell script (“Sophos_kill_local.ps1”) to terminate processes associated to Sophos safety software program on the compromised host.
The concluding levels entail utilizing the Home windows Job Scheduler to launch ransomware and wiper payloads, however not earlier than gathering and exfiltrating delicate details about their victims by way of a file-sharing service known as DropMeFiles within the type of ZIP archives.
“The attackers used a model of the favored LockBit 3.0 ransomware, compiled from publicly out there supply code, to encrypt the info,” Kaspersky researchers mentioned. “Earlier than beginning work, the ransomware terminates processes which will intrude with the encryption of particular person information.”
The wiper, equivalent to the Shamoon malware, rewrites the grasp boot file (MBR) on related drives and overwrites all file contents with randomly generated bytes, successfully stopping system restoration.
“The group sticks to a publicly out there and acquainted arsenal of malware instruments, which suggests it makes none of its personal,” Kaspersky famous. “This makes it potential to detect and stop Twelve’s assaults in due time.”
