Epsilon Red Ransomware
Epsilon Red is a ransom tool targeting Windows systems. First seen in May 2021, it is delivered through vulnerable Microsoft Exchange servers.
Summary
Epsilon Red is a ransom tool targeting Windows systems. First seen in May 2021, it is delivered through vulnerable Microsoft Exchange servers.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
First observed in May 2021, Epsilon Red is a ransomware written in Go and is the final-stage payload in human-operated attacks. It is relatively simple, only targeting folders on the compromised host. It is delivered via unpatched vulnerabilities in a Microsoft Exchange server, with operators then using a series PowerShell scripts to deliver other components of the attack, before launching Epsilon Red.
Delivery
At the time of publication, Epsilon Red has been observed in only one ransomware attack. Operators gain access to the network via a vulnerable Microsoft Exchange server, possibly using the ProxyLogon exploit. Having gained access to the server, Remote Desktop Protocol (RDP) and Windows Management Instrumentation are used to deploy software and run a series of PowerShell scripts on machines in the network.
An initial PowerShell script is used to extract additional PowerShell scripts and an Epsilon Red payload from a 7Z archive file. It sets up scheduled tasks to run the extracted scripts, then waits for one hour before modifying firewall settings to only allow inbound connections via RDP or the legitimate Remote Utilities application, which is also installed at this point.
Once executed, the additional PowerShell scripts perform a series of tasks to prepare the system for the Epsilon Red payload, including:
- terminating targeted services and processes
- deleting all Volume Shadow Copies
- deleting Windows Events Logs
- disabling security tools and cloud backup services
- extracting the Security Account Manager (SAM) file to access password hashes
- granting the Everyone group access permission to all local drives
Activities
If successful, Epsilon Red is launched by another PowerShell script and scans its host’s hard drive to create a list of directories. It encrypts each subdirectory in the list separately with a new child process, resulting in many copies of the process running simultaneously. All files within each folder are encrypted, including Dynamic Link Libraries (DLLs) and executables, which could potentially leave the system non-functional. Once encrypted, files are appended with the EPSILONRED extension, and a ransom note is dropped into each compromised folder. A custom version of the open-source tool EventCleaner is also deployed to remove evidence of the attack by erasing and modifying event logs.
Remediation advice
If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:
- Critical data is frequently saved in multiple backup locations.
- At least one backup is kept offline at any time (separated from live systems).
- Backups and incident recovery plans are tested to ensure that data can be restored when needed.
- User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
- Infected systems are disconnected from the network and powered down as soon as practicable.
- Any user account credentials that may have been compromised should be reset on a clean device
- Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.
Additionally, to prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 11 June 2021 1:26 pm