Yanluowang Ransomware Used By a Threat Actor Previously Linked to Thieflock Ransomware

Description

FortiGuard Labs is aware of a report that Yanluowang ransomware was recently used by a threat actor who previously employed Thieflock ransomware. According to Symantec, the threat actor focuses on organizations across multiple sectors in the United States. Yanluowang ransomware was first reported in October 2021. Yanluowang attackers demand ransomware from the victims and tell them not to contact law enforcement or ransomware negotiation firms. If they do, the attackers threaten the victim with distributed denial of service (DDoS) attacks as well as making phone calls to alert the victim's business partners.


Why is this Significant?

This is significant because the attacker, who mainly targets U.S. corporations, appears to have switched their arsenal from Thieflock ransomware to Yanluowang ransomware. Because of this, companies in the United States need to pay extra attention to the tools, tactics, and procedure (TTPs) that this attacker uses.


What TTPs is the Attacker Known to Use?

According to the report, the attacker uses the following tools:

  • GrabFF: A tool to dump passwords from Firefox
  • GrabChrome: A tool to dump passwords from Chrome
  • BrowserPassView: A tool to dump passwords from Web browsers such as Internet Explorer, Chrome, Safari, Firefox, and Opera
  • KeeThief: A PowerShell script to copy the master key from KeePass
  • Customized versions of Secretsdump: Security Account Manager (SAM) credential-dumping tools
  • FileGrab: A tool to capture newly created files in Windows file systems
  • Cobalt Strike Beacon: A tool that allows the attacker to perform command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement.
  • ProxifierPE: A tool to proxy connections back to attacker's Command and Control server (C&C)
  • ConnectWise: A remote desktop software that provides remote access to the attacker
  • AdFind: A command-line Active Directory query tool
  • SoftPerfect Network Scanner: A tool to discover hostnames and network services
  • BazarLoader: A backdoor program that is used to deploy additional malware and steal confidential information from the compromised machine. The attacker typically downloads BazarLoader using PowerShell.

The initial attack vector is unclear so suspicious emails must be handled with caution and the patches for products and software that are used in the company must be applied.


What is Yanluowang Ransomware?

Yanluowang ransomware is reported to perform the following actions:

  • Terminates all hypervisor virtual machines (VMs) running on the compromised machine
  • Terminates processes, such as SQL and back-up solution Veeam, that are listed in processes.txt
  • Encrypts files on the victim's machine and appends the .yanluowang extension to them
  • Drops a ransom note

In the ransom note, Yanluowang attacker asks the victim to follow their rules including not to contact law enforcement or ransomware negotiation companies or else the attacker will launch distributed denial of service (DDoS) attacks against the victim and will make phone calls to the victim's employees and business partners.


What is the Status of Protection?

FortiGuard Labs provides the following AV coverage against Yanluowang ransomware:

W32/Ylwransom.A!tr.ransom

All network IOCs are blocked by the WebFiltering client.