Ransom X Ransomware
First seen in June 2020, Ransom X has been responsible for a number of ransomware attacks against government agencies, particularly throughout the USA
Summary
First seen in June 2020, Ransom X has been responsible for a number of ransomware attacks against government agencies, particularly throughout the USA
Affected platforms
The following platforms are known to be affected:
The following platforms are also known to be affected:
VMWare ESXi Versions: all supported
Threat details
Introduction
Ransom X (AKA Defray777, Ransom.exx, or RansomExx) is a ransomware tool that has been observed in attacks against US government agencies.
Delivery
At the time of publication, it is not known exactly how Ransom X is distributed, although it is thought to be executed manually.
Activities
When Ransom X is run it initially terminates a range of processes including security software, remote administration tools and database servers. It then takes further steps to obstruct recovery attempts including clearing Windows event logs, deleting NTFS journals, disabling System Restore and the Windows Recovery Environment, deleting Windows backup catalogs and wiping free space on local storage.
When Ransom X encrypts data it appends a custom extension associated with the victim to affected filenames. A ransom note named ![extension]_READ_ME!.txt is saved in each encrypted directory. This note includes the victim organisation name, an email address to contact, and instructions on how to pay the ransom. While running, Ransom X displays an on-screen console with information about the encryption process.
Threat updates
| Date | Update |
|---|---|
| 4 Feb 2021 |
VMWare ESXi targeting
The threat actor controlling Ransom X has recently been observed exploiting vulnerabilities in VMWare ESXi to shut down virtual machines and encrypt virtual storage devices directly on the hypervisor. Once initial access has been gained to a network, malicious Service Location Protocol (SLP) messages are sent to take control of the ESXi device. VMWare ESXi administrators should ensure that all recent security updates have been applied. Service Location Protocol (SLP) may also be disabled to help prevent a successful attack, if not required. |
| 9 Nov 2020 |
Linux targeting
A new version of Ransom X has been observed targeting Linux systems |
Remediation advice
If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:
- Critical data is frequently saved in multiple backup locations.
- At least one backup is kept offline at any time (separated from live systems).
- Backups and incident recovery plans are tested to ensure that data can be restored when needed.
- User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
- Infected systems are disconnected from the network and powered down as soon as practicable.
- Any user account credentials that may have been compromised should be reset on a clean device
- Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.
Additionally, to prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 5 February 2021 8:22 am