Zeoticus Ransomware
Ransomware that targets Windows systems and operates completely offline, without a command and control function.
Summary
Ransomware that targets Windows systems and operates completely offline, without a command and control function.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
Zeoticus is ransomware that targets Microsoft Windows and executes completely offline, with no communication to remote systems.
Delivery
Zeoticus is sold online and is likely to be delivered via spam email and similar methods that require user interaction to execute.
Activities
When Zeoticus is executed, it copies itself into the Windows and AppData directories. It then terminates several running processes that could interfere with its operation. Zeoticus then gathers system information and creates a registry run key to be started automatically.
Zeoticus then encrypts specified filetypes using a combination of symmetric and asymmetric algorithms, including XChaCha20, Poly1305, XSalsa20 and Curve25519. Encrypted filenames are appended with the extension .2020END and the email address of the attacker. Zeoticus can discover and encrypt files on network shares.
The ransom note is copied to the Windows installation directory and is also mounted on a new volume. The note instructs victims to contact the attacker by email and demands a ransom payment in bitcoin. The desktop background of the system is also changed to a ransom note in some versions of Zeoticus.
Remediation advice
If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:
- Critical data is frequently saved in multiple backup locations.
- At least one backup is kept offline at any time (separated from live systems).
- Backups and incident recovery plans are tested to ensure that data can be restored when needed.
- User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
- Infected systems are disconnected from the network and powered down as soon as practicable.
- Any user account credentials that may have been compromised should be reset on a clean device
- Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.
Additionally, to prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 7 September 2021 12:31 pm