{"id":48760,"date":"2024-04-16T15:09:08","date_gmt":"2024-04-16T12:09:08","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=48760"},"modified":"2026-03-28T05:34:25","modified_gmt":"2026-03-28T02:34:25","slug":"leaked-lockbit-builder-based-ransomware-impersonates-employees-and-self-spreads-incident-analysis","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/leaked-lockbit-builder-based-ransomware-impersonates-employees-and-self-spreads-incident-analysis\/","title":{"rendered":"Leaked LockBit builder-based ransomware impersonates employees and self-spreads: incident analysis\u00a0"},"content":{"rendered":"\n

15 April 2024<\/strong><\/p>\n\n\n\n

LockBit persists: the 2022 leaked builder remains a threat. Following a recent incident, the Kaspersky Global Emergency Response team is <\/strong>shedding light<\/strong><\/a> on an attack where adversaries crafted their own variant of encryption malware equipped with self-propagation capabilities. Exploiting stolen privileged administrator credentials, the cybercriminals breached infrastructure. This incident took place in West Africa, but other regions also experiencing attacks with builder-based ransomware, albeit lacking the sophisticated features observed in this case. <\/strong><\/p>\n\n\n\n

The latest incident occurred in Guinea-Bissau and revealed that custom ransomware employs unseen techniques. It can create an uncontrolled avalanche effect, with infected hosts attempting to spread the malware further within the victim\u2019s network. After the recent occurrence, Kaspersky is providing the detailed analysis<\/a>.<\/p>\n\n\n\n

Impersonation. <\/strong>Leveraging illicitly-acquired credentials, the threat actor impersonates the system administrator with privileged rights. This scenario is critical, as privileged accounts provide extensive opportunities to execute the attack and gain access to the most critical areas of the corporate infrastructure. <\/p>\n\n\n\n

Self-spreading.<\/strong> The customized ransomware can also spread autonomously <\/strong>across the network using highly-privileged domain credentials and conduct malicious activities, such as disabling Windows Defender, encrypting network shares, and erasing Windows Event Logs to encrypt data and conceal its actions.<\/p>\n\n\n\n

The malware\u2019s behavior results in a scenario where each infected host attempts to infect other hosts within the network. <\/p>\n\n\n\n

Adaptive features.<\/strong> The customized configuration files, along with the aforementioned features, enable the malware to tailor itself to the specific configurations of the victimized company\u2019s architecture<\/a>. For example, the attacker can configure the ransomware to infect only specific files, such as all .xlsx and .docx files, or only a set of specific systems. <\/p>\n\n\n\n

When executing this custom build in a virtual machine, Kaspersky observed it performing malicious activities and generating a custom ransom note on the desktop. In real scenarios, this note includes details on how the victim should contact the attackers to obtain the decryptor. <\/p>\n\n\n\n

\"K16_ssict_822_558\"<\/a><\/figure>\n\n\n\n

\u201cThe LockBit 3.0 builder was leaked in 2022, but attackers still actively use it to create customized versions \u2013 and it doesn\u2019t even require advanced programming skills. This flexibility gives adversaries many opportunities to enhance the effectiveness of their attacks, as the recent case shows. It makes these kinds of attacks even more dangerous, considering the escalating frequency of corporate credential leaks<\/em>\u201d, – says Cristian Souza, Incident Response Specialist at Kaspersky Global Emergency Response Team. <\/p>\n\n\n\n

Kaspersky also found that attackers used the SessionGopher<\/a> script to locate and extract saved passwords for remote connections in the affected systems. <\/a><\/p>\n\n\n\n

Incidents involving various types of techniques based on the leaked LockBit 3.0 builder \u2013 but lacking the self-propagation and impersonation capabilities found in Guinea-Bissau \u2013 regularly occur in various industries and regions. They were observed in Russia, Chile, and Italy, and the geography of attacks may be further expanding.<\/p>\n\n\n\n

Kaspersky products detect the threat with the following verdicts: Trojan-Ransom.Win32.Lockbit.gen, Trojan.Multi.Crypmod.gen, Trojan-Ransom.Win32.Generic. The SessionGopher script is detected as HackTool.PowerShell.Agent.l or HackTool.PowerShell.Agent.ad.<\/p>\n\n\n\n

LockBit is a cybercriminal group offering ransomware as a service (RaaS). In February 2024, an international law-enforcement operation seized<\/a> control of the group. Few days after the operation, the ransomware group defiantly announced<\/a> that it was back in action.<\/p>\n\n\n\n

Kaspersky recommends the following general measures to mitigate ransomware attacks: <\/p>\n\n\n\n