SMAUG Ransomware

SMAUG is a new ransomware-as-a-service tool available through dark web forums that can target Windows, Mac, and Linux systems. Designed specifically to compete against other RaaS tools, it includes several advanced features such as offline support.

Threat ID:: CC-3614
Category:: Ransomware
Threat Severity:: Medium
Threat Vector:: Email spam, Phishing, Insecure network
Published:: 8 September 2020 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Affected platforms

The following platforms are known to be affected:

Versions: all supported

Microsoft Windows

Versions: all supported

macOS

Versions: most major distributions

Linux

Threat details

Introduction

First observed in April 2020, SMAUG is a sophisticated ransomware-as-a-service (RaaS) tool able to build and deploy payloads on all major operating systems.

Smaug's creators claim it is intended to compete with other 'full-service' RaaS tools such as Nefilim and SATAN. As such, it offers a number of features, including an automated ransom system and offline functionality, not available in its competitors.

Delivery

As with most RaaS builders, SMAUG affiliates are responsible for delivery of their payloads.

At the time of publication, only Go-based 64-bit EXE payloads have been observed, although it is highly likely payloads using other filetypes exist in the wild.

A service agreement between SMAUG's creators and its affiliates also explicitly forbids affiliates from operating SMAUG campaigns in CIS countries, although there currently appears to be no functionality within SMAUG payloads to determine the location of infected systems.

Activities

Once delivered to a system, SMAUG payloads will perform a series of anti-analysis and emulation checks. Windows payloads then attempt to alter Registry keys to maintain persistence (it is not known how persistence is maintained on macOS or Linux systems), before attempting to disable any running security services.

If successful, SMAUG online payloads collect user and system information as well as web browser credentials. This information is then sent to an affiliate-controlled command and control server. Offline payloads do not collect any significant data and move straight to the encryption process.

Files are encrypted using AES-256 with an affiliate-specified key. This key can be unique to each SMAUG instance or identical for all instances affecting a single organisation, and is itself encrypted using RSA-2048. Encrypted files are appended with a 36 digit alphanumeric code, whilst a ransom note is dropped in all affected directories.

Remediation advice

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:

Critical data is frequently saved in multiple backup locations.
At least one backup is kept offline at any time (separated from live systems).
Backups and incident recovery plans are tested to ensure that data can be restored when needed.
User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
Infected systems are disconnected from the network and powered down as soon as practicable.
Any user account credentials that may have been compromised should be reset on a clean device
Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Additionally, to prevent and detect an infection, NHS Digital advises that:

Secure configurations are applied to all devices.
Security updates are applied at the earliest opportunity.
Tamper protection settings in security products are enabled where available.
Obsolete platforms are segregated from the rest of the network.
IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
Administrative accounts are only used for necessary purposes.
Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.