50 Things I learned about the RansomEXX group

AboveL A redacted note issued by RansomEXX

Shiva Parasram created this list of factoids about the ransomware group RansomEXX and published it to his LinkedIn page. It is reproduced here with his kind permission.

🎯 Emergence: RansomEXX came into the spotlight around 2020, primarily targeting notable organizations.
📛 Alias: They are also referred to as Defray777, stemming from a unique identifier in their ransomware code.
🔒 Encryption Techniques: RansomEXX employs strong encryption, making it difficult to restore files without their decryptor.
🌎 Global Attacks: While selective, they have targeted entities across various continents.
🔍 Specific Targets: They have a penchant for large corporations and public sector organizations.
🖥️ Hands-on Approach: RansomEXX prefers manual operations inside a network over automated techniques.
💽 Data Theft: Before encrypting systems, they often steal sensitive data.
📢 Double Extortion: They not only encrypt but threaten to leak stolen data if ransoms aren’t paid.
📜 Personalized Notes: Their ransom communications are typically customized based on the victim.
💰 RaaS: They do operate independently but have been known to operate as a RaaS (Ransomware-as-a-Service) model.
🎣 Phishing Mastery: Deceptive emails are often their initial entry method into networks.
🔗 Exploit Chains: They often chain together multiple software vulnerabilities for deeper access.
🖇️ Unpatched Software: RansomEXX capitalizes on outdated and vulnerable software, especially public-facing applications.
🧰 Diverse Toolkit: Their arsenal includes a mix of custom and off-the-shelf tools.
🔑 Mimikatz: A favored tool for credential dumping and privilege escalation.
⚡ PowerShell Empire: A post-exploitation framework granting wide-ranging capabilities.
💼 Cobalt Strike: Originally a legitimate pen-testing tool, it’s now a favorite among attackers.
🌐 Lateral Tactics: Tools like PsExec help them traverse laterally across compromised networks.
🔍 Network Recon: They actively map networks using tools like BloodHound.
☁️ Data Movement: Rclone can be misused for moving data stealthily to cloud storage.
🔍 Active Directory: They mine AD data using tools like AdFind for understanding permissions and relations.
🚪 Misconfigurations: They exploit insecure settings or exposed services.
📊 Target Research: Before an attack, they spend time researching potential victims for maximum impact.
💰 High Ransoms: Their demands can be exorbitant, reflecting their target’s perceived ability to pay.
📈 Tailored Operations: RansomEXX customizes their attack methods based on the target’s environment.
🛡️ Avoiding Detection: They use “living off the land” tactics to blend into environments.
🚷 No Known Decryptor: As of the last known update, no public decryption tool can counter RansomEXX.
📞 Communication Channels: They often provide a communication channel for ransom negotiations.
🔥 Destruction: In some cases, they may try to delete backups or disrupt recovery efforts.
🌍 Varied Victims: Targets have included healthcare, government entities, and critical infrastructure.
🔄 Network Propagation: Once inside, they work to gain higher privileges and access more systems.
🔐 Credential Theft: Capturing credentials is a priority to facilitate movement and persistence.
🛑 Stopping Security: They might attempt to disable security software or services.
🗂️ File Types: They target a broad range of file extensions, ensuring vital data gets encrypted.
⌛ Dwell Time: They can remain in networks for days to weeks before launching the ransomware.
📝 Detailed Notes: Ransom notes often provide detailed payment instructions using cryptocurrencies.
⚖️ Negotiations: Some victims have successfully negotiated lower ransoms.
🚫 Decryption Issues: Even after payment, decryption isn’t always smooth, with occasional technical issues.
🌐 Network Disruptions: Their operations can disrupt not just endpoints but entire networks.
🚫 No Warranty: Paying the ransom doesn’t guarantee data safety or prevent future attacks.
🕵️ Stealth: They often clean logs or use encrypted channels to avoid detection.
📦 Payload Delivery: Various methods, from malicious attachments to drive-by downloads, are used.
📡 Command & Control: They establish robust C2 communications to control compromised systems.
🛡️ Backup Importance: The best defense against their attack is having secure and isolated backups.
🚫 No Discrimination: Despite being selective, no industry is truly safe from their attention.
🖲️ VPN Exploits: Vulnerable VPNs have been a notable point of entry.
📅 Continuous Evolution: Their techniques and tools evolve to counteract defenses.
💡 Awareness: Training staff to spot phishing and suspicious behavior can prevent initial access.
🚀 Rapid Response: Quick detection and response can mitigate the damage they cause.
🔒 Layered Defense: Employing a multi-layered security approach is crucial in defending against groups like RansomEXX.

Reaching the youth media audience

By Mark Lyndersay / April 22, 2024

Credibility has become personal. Who is delivering the news and what is understood about them is becoming as important as the journalism itself

Huawei, CTU partner to drive regional digital development

By Press Release / April 22, 2024

The agreement will enhance the CTU’s collaborative efforts to address key ICT challenges in the region and symbolises its shared commitment with Huawei to foster a digitally empowered Caribbean.

IGT offers technology for children on the autism spectrum

By Press Release / April 22, 2024

Organisations supporting children with autism spectrum disorders and other neurological developmental conditions have been increasingly using technology to assist with their complex communication and learning needs.

Digicel invites Caribbean businesses to participate in regional digital transformation survey

By Press Release / April 21, 2024

"We invite businesses of all sizes and sectors to be at the forefront of digital transformation knowledge and innovation."

Pinaka Consulting partners with Flexxon

By Press Release / April 15, 2024

AI is an enabler. Threat actors are getting better at communication in English using ChatGPT.

Next-gen news consumers. What do they want?

By Mark Lyndersay / April 15, 2024

It's no longer simply enough to keep producing the same news menu for an aging demographic and milking that diminishing audience.

Let’s talk backup. Again

By Mark Lyndersay / April 8, 2024

Computers have a functional life of around five years, and most media will last roughly that long before either becoming more prone to failure or simply running out of room.

Press Releases

TSTT to invest $160m in network, deploy VOLTE

By Press Release / April 5, 2024

"Trinidad and Tobago’s only indigenous communications solutions provider has successfully returned to a period of profitability."

Press Releases

Huawei doubles profits in 2023

By Press Release / April 5, 2024

Throughout the past year, its ICT infrastructure business remained solid, and its consumer business met expectations. Both its cloud computing and digital power businesses grew steadily.

The United States vs Apple

By Mark Lyndersay / April 1, 2024

Apple's services, including AppleTV, Apple Music and Apple Pay, account for 22 per cent of the company's revenue and it's drawing the lion's share of the concern articulated in the...