The Ransomware Roundup report aims to provide readers with brief insights into the evolving ransomware landscape and the Fortinet solutions that protect against those variants.
This edition of the Ransomware Roundup covers the 8base ransomware.
8base is a financially motivated ransomware variant most likely based on the Phobos ransomware.
FortiGuard Labs has observed SmokeLoader variants delivering the 8base ransomware.
Such SmokeLoader samples include bab3c87cac6db1700f0a0babaa31f5cd544961d1b9ec03fd8bcdeff837fc9755 and ea6adefdd2be00d0c7072a9abe188ba9b0c9a75fa57f13a654caeaaf4c3f5fbc. The 8base ransomware may also rely on other distribution methods.
According to data collected through Fortinet's FortiRecon service, the 8base ransomware has targeted multiple industry verticals.
Once the ransomware is executed, it looks for files to encrypt.
The ransomware avoids encrypting files inside the Caches folder, most likely because doing so may lead to software problems.
Killing these processes ensures that any files open in them, such as MS Office files, will be closed so the ransomware can encrypt them.
The 8base ransomware also checks for file size, with a threshold set at 1.5MB. The ransomware fully encrypts files smaller than 1.5MB. On the other hand, it partially encrypts files larger than 1.5MB, most likely to increase the encryption speed.
The encryption speed is often a subject of competition among ransomware developers because they want to encrypt as many files as possible before the victim becomes aware of the infection.
To elaborate a bit, the ransomware injects blocks comprised of 0x40000 null bytes into various parts of the final output/encrypted file, starting at the beginning of the file.
Figure 4: File size check done by the 8base ransomware.
Figure 7: Ransom note displayed by the 8base ransomware variant discovered in November.
Figure 8: Text version of the ransomware note dropped by the recent 8base ransomware variant.
The 8base ransomware group owns a TOR site where victims can contact the threat actor.
The 8base ransomware TOR site includes a victim list, contact form, FAQ, and terms of service.
Figure 9: Top page of the 8base ransomware TOR site.
Organizations such as CISA, NCSC, the FBI, and HHS caution ransomware victims against paying a ransom partly because the payment does not guarantee that files will be recovered.
For organizations and individuals affected by ransomware, the FBI has a Ransomware Complaint page where victims can submit samples of ransomware activity via their Internet Crimes Complaint Center.
This Cyber News was published on feeds.fortinet.com. Publication date: Thu, 28 Dec 2023 16:43:04 +0000