Multiple attackers:
A clear and present danger
Competition has always been fierce among cryptominers
and RATs, but ransomware bucks the trend.
Since their inception, the Sophos Managed Detection and Response (MDR) and Rapid
Response (RR) teams have been called in to investigate hundreds of ransomware
incidents, including intervening in active attacks where the attackers were still on thetarget’s network.
In recent months, we’ve noticed an uptick in the number of cases where organizations
have been attacked multiple times. Some attacks take place simultaneously; others are
separated by a few days, weeks, or months. Some involve different kinds of malware, or
double – even triple – infections of the same type.
Multiple attacks can be devastating for victims. Not only do they complicate remediation
and business continuity plans, but the financial, reputational, and psychological impacts
can be overwhelming. Our findings suggest a typical gap of around six weeks between
attacks in cases where the same organization is attacked multiple times.
We wanted to explore how (and why) multiple attacks happen to certain targets. Recent
case studies from our MDR and RR teams help illustrate the question of how these
attacks transpire; cooperation and competition among threat actors can explain thewhy. Based on this analysis, we’ve provided eight pieces of advice that can help prevent
multiple attacks.

By Matt Wixey, Sophos X-Ops

A Sophos X-Ops Active Adversary Whitepaper August 2022

Multiple attackers: A clear and present danger

Contents
Introduction

2

A sequence of unfortunate events

2
3

The big bugs
Takeaway 1: Updates for absolutely everything

3

Takeaway 2: Prioritize the worst bugs first3

Leaving the door open

4

Case study: Exposed RDP applications lead to two attacks in five weeks

4

Takeaway 3: Mind your configurations

5

Selling access to your network to the highest bidder

5

Case study: Ransomware affiliate uses both Hive and Conti

7

Takeaway 4: Assume other attackers have found your vulnerabilities

11

Takeaway 5: Don’t slow-walk addressing an attack in progress11

Why can’t we be friends?
Case study: Once, twice, three times encrypted

1216Case study: Backdoor leads to another attack

18

Takeaway 6: Ransomware plays nicely with ransomware

19

Takeaway 7: Attackers open new backdoors

19

Takeaway 8: Some attackers are worse than others

19

Guidance20

Acknowledgments

21

References

21

A Sophos X-Ops Active Adversary Whitepaper August 2022

1

Multiple attackers: A clear and present danger

Introduction
There’s a well-worn industry phrase about the probability of a cyberattack: “It’s not if, but when.” But someof the incidents our Managed Detection and Response (MDR) and Rapid Response (RR) teams haveinvestigated recently may force the industry to consider a change to this rule-of-thumb: The question is notif, or when – but how many times?
We’ve noticed an uptick in the number of cases where organizations have been attacked multiple times.¹
Some attacks take place simultaneously; others are separated by a few days, weeks, or months. Some
involve different kinds of malware, or double – even triple – infections of the same type.
There are a variety of underlying causes, from big vulnerabilities and misconfigurations to threat actors
competing for resources and dominance in an increasingly crowded threat environment.
Whatever the root cause, multiple attacks can be devastating for victims. Not only do they complicate
remediation and business continuity plans, but the financial, reputational, and psychological impacts can be
overwhelming. Just when you think that the worst has finally happened – and you now know for certain thatit’s ‘when,’ and not ‘if’ – you’re hit with another attack. Our findings suggest a typical gap of around six weeks
between attacks in cases where the same organization is attacked multiple times.
We wanted to explore how (and why) multiple attacks happen to certain targets. Recent case studies
from our MDR and RR teams help illustrate the question of how these attacks transpire; cooperation andcompetition among threat actors can explain the why. Based on this analysis, we’ll provide eight pieces ofadvice that can help prevent multiple attacks.

A sequence of unfortunate events
Unsurprisingly, the root causes of most multiple exploitations frequently come down to two issues: Thetargets fail to address significant exploitable vulnerabilities in either software or hardware; and, after anattack, victims fail to address malicious tooling or misconfigurations of hardware or software, left in place by
the earlier attackers.
But there’s a little more complexity to it than that. The cases we discuss below indicate that there’s often a
specific sequence of exploitation – cryptominers (a proverbial canary in the coal mine) arrive first, followed
by wormable botnet builders (such as Mirai), then malware delivery systems (webshells and/or RATs), who
may feed data to initial access brokers (IABs), and finally, ransomware.
Some of these threat actors are interdependent (IABs, for example, enable some ransomware attacks).
Others will happily co-exist: Cryptominers and ransomware have different objectives, so they don’t have any
reason to directly interfere with each other² (although ransomware may encrypt cryptominers’ configuration
files, or artefacts from other attacks, like webshells – rendering those attacks inert).
We’ve also seen organizations hit by multiple ransomware attacks, sometimes because the threat actors
didn’t know a previous infection had occurred, but more often because they simply didn’t care. One of thecase studies we’ll explore involved a triple ransomware incident, with some files being encrypted by threedifferent ransomware strains. In that case, our investigation was complicated by the third threat actor not
only erasing traces of their attack, but also those of the previous two.
On the other side of the coin, some threat actors don’t play nicely together, and actively work against
other infections or threat actors. Cryptominers, for example, often try to terminate the processes of othercryptominers, because CPU resources are finite, and a concurrent infection generates less revenue. Thereare exceptions, of course; some cryptominers, such as Outlaw, focus on different targets (IoT devices andLinux servers, via brute-force SSH attacks) to most of their rivals, and therefore aren’t too concerned about
competition. They may still have ‘kill scripts’ but rarely need to use them.³
We’ll talk more about the relationships between threat actors shortly, but before that, let’s look at a few
examples of how big vulnerabilities can lead to multiple attacks.

A Sophos X-Ops Active Adversary Whitepaper August 2022

2

Multiple attackers: A clear and present danger

The big bugs
The ProxyLogon (CVE-2021-26855⁴) and ProxyShell (CVE-2021-34473,5 CVE-2021-34523,6 and CVE2021-312077) vulnerabilities were first disclosed in March and August 2021, respectively. We covered both
ProxyLogon and ProxyShell extensively at the time ⁸,⁹ and our follow-up research revealed that cryptominers –including Lemon Duck¹⁰ and Tor2Mine¹¹ – were quick to take advantage. Tor2Mine even has a dedicated, heavily
obfuscated 116-line PowerShell script designed to kill processes relating to over 70 competitors, including
other miners, RATs, and ‘clipper’ malware that swaps cryptocurrency wallet addresses on a user’s clipboard.
The Squirrelwaffle malware delivery botnet also abused ProxyShell in 2021.¹²
Then came the ransomware. The earliest variants abusing ProxyLogon and ProxyShell appeared to be relatively
crude, possibly because they were developed to exploit vulnerable hosts before they could be patched. These
early variants included DearCry¹³ and Black Kingdom ransomware,¹⁴ which targeted organizations in March
2021.
Another new ransomware strain, LockFile,¹⁵ was discovered in August, followed by Conti affiliate attacks in
September 2021. In February 2022, we observed Conti attacking a healthcare organization at the same time
as a Karma ransomware affiliate¹⁶ (more on this one later, as we saw an interesting dynamic between the twogroups in that case).
It’s worth noting that attackers who exploit ProxyLogon/ProxyShell often drop webshells on compromised
servers. If organizations were compromised, but didn’t perform a clean-up after patching, there may still bemany of these backdoors – and attacker-created email accounts – on now-patched Exchange servers, waiting
for threat actors to use or sell them.
Log4Shell (CVE-2021-44228¹⁷), disclosed in December 2021, followed a similar sequence of events. In thedays following the release of public proofs-of-concept, we observed a significant amount of scanning activity,¹⁸although not as many attacks as we expected. The lull didn’t last; cryptominers soon arrived¹⁹ (followed closely
by webshells and backdoors deployed by IABs), and, as noted above, many came armed with functions forkilling other miners.
Interestingly, Jin, a cryptominer we investigated in the above linked report, even terminated the Tomcat service
vulnerable to Log4Shell, presumably to prevent other attackers from exploiting that infection vector. Threat
actors locking the door after themselves isn’t all that common, but it does happen, and we’ll explore it later.
Exploitation of the recent remote code execution vulnerability in Atlassian²⁰ (CVE-2022-26134²¹) has, sofar, followed the same pattern. As we previously reported, we saw attackers who exploited the Atlassianvulnerability deliver a variety of payloads, including cryptominers and webshells, followed some time later by
ransomware attempts.

Takeaway 1: Updates for absolutely everything
It sounds simple, but: Update everything. One of our key findings is that cryptominers, and webshells andbackdoors deployed by IABs, often come first when a vulnerability has been disclosed, and the latter typicallytry to operate stealthily – so you might think you’ve avoided an attack, when in fact there’s already malware on
your system. That might be compounded (in a subsequent attack) by ransomware. Patching early is the best
way to avoid being compromised in the future – but it doesn’t mean you haven’t already been attacked. It’s
always worth checking that your organization wasn’t breached prior to patching.

Takeaway 2: Prioritize the worst bugs first
But how can you patch early, and how do you know what to patch? Prioritizing can be a big ask, given how
many vulnerabilities are disclosed (18,429 in 2021,²² more than 50 a day on average, and the greatest numberof reported vulnerabilities ever disclosed during a calendar year). So focus on two key elements: 1) critical bugs
affecting your specific software stack; and 2) high-profile vulnerabilities that could affect your technology.
There are paid services which offer vulnerability intelligence, but there are also free tools which let you set
up custom alerts for particular products. Bug Alert²³ is a non-profit service that aims to give early warningof high impact bugs. Monitoring ‘infosec Twitter’ is also recommended, as that’s where many prominent
vulnerabilities are discussed when first released. Or you could use CVE Trends,²⁴ which collates data fromseveral sites to show the most-talked-about vulnerabilities.

A Sophos X-Ops Active Adversary Whitepaper August 2022

3

Multiple attackers: A clear and present danger

Leaving the door open
Remote access misconfigurations – typically internet-exposed, unsecured RDP servers, as well as
applications like RDWeb or AnyDesk – are also a leading cause of multiple attacks, when incident responders
fail to address the misconfiguration after the first incident. In the following case study, the first threat actor
used RDP to gain access. But the issue wasn’t fixed, leading to a second attack.

Case study: Exposed RDP applications lead to two attacks in five weeks
April 8th 2022: A threat actor gains access to an organization’s network via an unsecured RDP server.
April 12th: The threat actor installs Advanced IP Scanner²⁵ to gather information about other devices on the network.
April 13th: The threat actor makes further RDP connections, adds a new administrative user, and executes Mimikatz.²⁶
April 19th: The attacker downloads several PowerShell malware stagers associated with keylogging and remotecommand execution.
April 20th: The organization removes the threats. Sophos’ MDR team makes several recommendations, including
disabling RDP access from the internet for several hosts, resetting passwords for compromised users, and performing adomain-wide credential reset. Some of these recommendations are not followed.
May 13th: A second threat actor authenticates over RDP to one of the hosts which Sophos recommended be secured after
the previous attack. Cobalt Strike²⁷ activity is observed.
May 27th: The threat actor authenticates over RDP.
May 29th: The threat actor performs reconnaissance on the domain, changes the credentials for an account, andattempts to save the registry hive. When this fails, they continue to perform reconnaissance, pivot to another host, anddump the ntds.dit file, a database of Active Directory information, including password hashes for all domain users. DNS
requests for anonfiles[.]com and fex[.]net, file-sharing services popular with threat actors, are observed. The threat actor
manages to upload a small amount of data, before the attack is stopped a few minutes later.
April 8 2022

April 13 2022

Initial access via RDP

April 20 2022

Mimikatz

April 12 2022

Threats removed

April 19 2022

ReconnaissancePowerShell stagers

First attack

May 29 2022

Attempt to save registry hive

May 13 2022

RDP, Cobalt Strike

Pivot, ntds.dit dumped

Second attack

Figure 1: Timeline of the attack

Takeaway 3: Mind your configurations
Misconfigurations – and a failure to remediate them after an attack – are a leading cause of multiple
exploitations. Cryptominer operators, IABs, and ransomware affiliates always look for exposed RDP and VPN
ports, and they’re among the most popular listings on most criminal marketplaces. If you do need remote
access and/or management over the internet, put it behind a VPN or a zero-trust network access solutionthat uses MFA as part of its login procedure.

A Sophos X-Ops Active Adversary Whitepaper August 2022

4

Multiple attackers: A clear and present danger

Selling access to your network to the highest bidder
Prominent vulnerabilities and misconfigurations can lead to compromises. It shouldn’t come as a surprisethat, if the underlying issues aren’t addressed after an attack, another threat actor might find and exploit
them too. In fact, it’s quite likely, given the amount of scanning that threat actors do.
But there can be many other causes of multiple attacks. Earlier we briefly discussed the differing priorities
of cryptominers and ransomware, so let’s take a closer look at how some features of the criminal ecosystem
might contribute to multiple attacks.
Criminals buy access to networks from IABs on criminal marketplaces (this is sometimes referred to as
Access-as-a-Service, or AaaS²⁸). Because IABs don’t want the victim to be alerted that a compromise has
occurred, they usually omit organization names and identifying information from their listings, but will
include details about sector, revenue, the size of the network, and what type of access is being offered, toattract potential buyers. In some cases, AaaS listings are auctioned off to the highest bidder. In others, it’s
down to interested parties to approach the seller privately and negotiate (usually away from the forum, onchat platforms like Jabber and Tox).
Here’s a typical AaaS listing on a prominent Russian-language criminal forum:

Figure 2: An AaaS listing on a criminal marketplace. This listing is being offered for auction, with start, step, and blitz(instant sale) prices provided

Notice anything? There’s no mention of exclusivity. And if we look at this forum’s rules, we see somethinginteresting. Roughly translated, one of the rules includes this instruction: “If the product is a one-time use
or loses its exclusivity in other cases, clearly say so at the top of the listing, or coordinate with the primarybuyer.”A Sophos X-Ops Active Adversary Whitepaper August 2022

5

Multiple attackers: A clear and present danger

Figure 3: The forum rules for buying and selling

In other words, sellers are supposed to give a clear indication as to whether a listing is exclusive. Here’s an
example of a listing that explicitly promises exclusivity, stating “Exclusive one sale only”:

Figure 4: An exclusive listing on a criminal marketplace

This isn’t specific to this forum, either – here’s an example from another prominent criminal site, where
the seller writes: “I will only disclose the company name to the final buyer to avoid snitches. Access is
exclusive. No profit sharing.” [emphasis in original]

Figure 5: An exclusive listing on a second criminal marketplace, this one for VPN access to an organization in
the Middle East

A Sophos X-Ops Active Adversary Whitepaper August 2022

6

Multiple attackers: A clear and present danger

But these tend to be the exception; many listings don’t include any mention of exclusivity at all. And while
reselling is generally forbidden on forums, it’s entirely possible that many AaaS listings are non-exclusive,and sold to multiple buyers to take advantage of growing demand – resulting in multiple attacks. In fact, onsome marketplaces, such as Genesis, exclusivity can even require an additional fee.
As an interesting side note, it appears that ransomware affiliate membership isn’t always exclusive either;some threat actors are members of multiple programs. For example, we recently investigated cases where
Hive and Conti ransomware variants shared the same infrastructure, despite the two groups having notabledifferences in their strategies, communication styles, and levels of operational security.²⁹

Case study: Ransomware affiliate uses both Hive and Conti
In March 2022, Sophos’ MDR team responds to a Conti ransomware incident, where the threat actor abused MSBuild.exe³⁰
to execute Cobalt Strike, beaconing to edgecloud[.]ink.
A few days later, the MDR team responds to a separate incident involving Hive ransomware, where the threat actor once
again abused MSBuild.exe to execute Cobalt Strike, and beaconed to the same domain.
The MDR team has since responded to other Hive ransomware incidents with overlapping infrastructure – suggesting
this activity is likely from a single ransomware affiliate.
March 29 2022

April 6 2022
Cobalt Strike

Cobalt Strikeedgecloud.ink

keycloud.ink

cloudkey.ink

Cobalt Strike

Conti

Hive

Figure 6: Shared infrastructure observed in recent Hive and Conti ransomware attacks in March and April 2022

A Sophos X-Ops Active Adversary Whitepaper August 2022

7

Multiple attackers: A clear and present danger

Figure 7: Details of the AvosLocker affiliate scheme

Lockbit’s affiliate rules, on the other hand, explicitly state that working with competitors is “not forbidden…but be sure toreport it and explain why and what you like from your competitors”:

Figure 8: Details of the Lockbit affiliate scheme, referring to working with competitors

And as we’ll see in our next case studies, ransomware threat actors sometimes benefit from each other’s activities, anddon’t seem to be overly concerned about competition.
Another possible reason for multiple attacks may be the existence of leak sites. Ransomware gangs publish
information about their victims, sometimes along with stolen data (the new Lockbit 3.0 site even lets others
bid to immediately access – or destroy – the data, putting more pressure on the victim to pay the ransom).

A Sophos X-Ops Active Adversary Whitepaper August 2022

8

Multiple attackers: A clear and present danger

As security researcher Kevin Beaumont has pointed out,³¹ contrary to popular opinion, targets who haven’t
responded to the ransom demands comprise most of the victims whose details have been disclosed on leaksites.

Figure 9: The Lockbit 2.0 leak site, showing details of current and past victims (redacted)

A Sophos X-Ops Active Adversary Whitepaper August 2022

9

Multiple attackers: A clear and present danger

Figure 10: The Lockbit 3.0 leak site, complete with a public auction enabling anyone to pay to extend the timer, or
destroy or download the organization’s data. A gallery of screenshots from the compromised network is provided as
proof

Why might that result in multiple attacks? Leak sites are public. An opportunistic, lower-tier ransomware
actor might reason that, if a victim hasn’t responded to a ransom demand, they might not have addressed
the infection vector, either. The threat actor has nothing to lose: Unlike buying an AaaS listing, it won’t costthem anything to target organizations that appear on leak sites.
Besides, the first ransomware attack might have failed to encrypt everything; if the second threat actor
encrypts further files, it may put additional pressure on the victim to pay up. We’ll discuss whether multiple
attacks benefit or disadvantage ransomware groups in the next section.
Non-ransomware threat actors might also seize on the data published on leak sites – including personal
information and passwords – to enable further attacks. Some ransomware groups actively encourage this;
ALPHV/BlackCat recently announced³² that they have made their leaks searchable, “to make the publisheddata more usable for the cybercriminal community.”

A Sophos X-Ops Active Adversary Whitepaper August 2022

10

Multiple attackers: A clear and present danger

Figure 11: A message from the ALPHV/BlackCat ransomware group to its affiliates. (Image source: @vxunderground³³)

Figure 12: The Black Basta ransomware leak site (organization names redacted)

Takeaway 4: Assume other attackers have found your vulnerabilities
Threat actors don’t operate in isolation. IABs might resell or relist their products, and ransomware affiliates
may use multiple strains – so one vulnerability or misconfiguration can lead to multiple threat actors
seeking to exploit your network.

Takeaway 5: Don’t slow-walk addressing an attack in progress
Being listed on a leak site may attract other, opportunistic threat actors. If you’re unfortunate enough to be
hit with a ransomware attack, take immediate action, in conjunction with your security teams and incident
response provider(s), to close the initial entry point and assess what data has been leaked, as part of yourwider remediation plan.

A Sophos X-Ops Active Adversary Whitepaper August 2022

11

Multiple attackers: A clear and present danger

Why can’t we be friends?
So what do the threat actors think about all this? Do they like sharing space, is it a necessary evil, or will theykick each other off infected systems given half a chance?
The history of malware³⁴ tells us that, in the past, the concept of cooperation (or, at the very least, peacefulco-existence) seemed alien to many threat actors. Alliances were few, often fragile, and could turn to enmity
at the smallest slight. Malware authors fought, constantly – over hosts, bragging rights, technical skills, andbotnet numbers.
In the mid-2000s, at the height of the ‘worm wars’, it was common for worms to contain specific routinesdesigned to remove other, competing worms, and to immunize themselves from attempts to be removed.
These battles were just as cutthroat as those that take place between cryptominers today; the developersof Netsky, Bagle, and Mydoom even traded insults in their source code, leading Graham Cluley – a seniortechnology consultant at Sophos at the time – to comment: “I would much rather they ranted at each otheron message boards instead of in raw code.”³⁵

Figure 13: The Mydoom author exchanges pleasantries with the Netsky developer in March 2004

Much like worms, cryptominers often employ a botnet model, albeit for different reasons. Cryptomining is a
low-yield, high-volume business model, so lots of infections are required for an acceptable return, and every
infected host’s CPU resources have to be maximized. That’s why cryptominers have contained routines tokill rivals pretty much since their inception. We dug deep into the archives of one criminal forum and found acryptominer specification sheet from 2014, offering “kill other Miner” [sic] as a feature for would-be buyers.

A Sophos X-Ops Active Adversary Whitepaper August 2022

12

Multiple attackers: A clear and present danger

Figure 14: An advert for a cryptominer, posted on a criminal forum in 2014

The hostilities aren’t confined to worms and cryptominers, of course. Back in the early 2010s, the crimeware
kit SpyEye³⁶ had a feature designed to hijack or remove infections³⁷ by one of its competitors, Zeus³⁸(although the two may have later merged³⁹). And in 2013, a malware package known as Omega Bot claimed
it could remove not only Zeus and SpyEye, but a host of other competitors:

Figure 15: Omega Bot offered for sale on a criminal forum in 2013

A Sophos X-Ops Active Adversary Whitepaper August 2022

13

Multiple attackers: A clear and present danger

This has continued until the present day, with modern RATs highlighting bot killing as a feature. The spec
sheet for Spectre RAT, offered for sale in June 2022, has this:Figure 16: The latest version of the Spectre RAT, advertised on a criminal forum

And a version of AsyncRAT,⁴⁰ which researchers recently observed⁴¹ exploiting the Follina vulnerability⁴²(CVE-2022-30190⁴³), offers “bot killer” as a bonus feature in this advert from December 2021:

Figure 17: AsyncRAT advertised on a criminal forum in 2021

It’s not just RATs, though; some threat actors go to more imaginative lengths to attack and disrupt rivals. In
February 2022, for example, researchers uncovered a campaign involving malicious packages in the npm
repository⁴⁴ – including one designed to attack other malware authors.

A Sophos X-Ops Active Adversary Whitepaper August 2022

14

Multiple attackers: A clear and present danger

Earlier, we also mentioned threat actors sometimes close the door behind themselves, patching or
removing the weakness(es) that they used to gain access. The Welchia worm famously did this in 2003;⁴⁵
it exploited the same vulnerability as the Blaster worm,⁴⁶ but once it was on a host, it downloaded a patch
from Microsoft, fixed the bug, and attempted to remove Blaster infections – all without performing any(deliberately) malicious activity itself. Welchia is an example of a so-called ‘helpful’ worm, also known as ananti-worm, or nematode⁴⁷ – although, like almost all anti-worms, it poses significant legal and ethical risks.
Welchia was also inadvertently harmful (though not destructive), causing denial-of-service conditions dueto the amount of network traffic it generated.
More recently, our research into the Kingminer cryptominer botnet revealed that Kingminer checks if theinfected system is vulnerable to the Bluekeep exploit, by enumerating the Windows version number andinstalled hotfixes. If no hotfixes are found, Kingminer disables any further RDP connections, to prevent
other malware from exploiting the bug to gain access (even though Bluekeep was rarely abused by othercryptominers at the time).⁴⁸
But as you might expect, given ransomware is a class of malware that has changed the face of security, it
does things differently. That’s not to say that ransomware groups always get along; they sometimes feudamong themselves on criminal forums⁴⁹ and steal each other’s code.⁵⁰ We’ve even seen threat actors trying
to sell ‘doxes’ of a “popular ransomware group”:

Figure 18: A (banned) user advertises personal information (‘dox’) of a ransomware group for sale on a criminal
forum in 2020

But when it comes to attacks, they generally seem happy to share targets. They don’t terminate rival
ransomware processes, or kick other malware out, because they’re not competing for CPU resources orbotnet sizes – and they’re not constrained by the need for long-term, undetected access. So there isn’t reallya need to ‘kill the competition.’
In fact, when the Maze ransomware group⁵¹ offered to point out security holes to paying victims, one user ona criminal forum asked: “How competitive is this situation to you?”Figure 19: A user inviting opinions on the Maze ransomware group’s offer to notify victims of vulnerabilities in their
networks after paying the ransom

Whether overlapping attacks benefit or disadvantage ransomware groups is another matter. On the one
hand, anything that puts pressure on the victim to pay is a desirable outcome, from the threat actors’
perspectives. We’ve seen various ways in which ransomware groups attempt to apply that pressure – someparticularly unpleasant⁵² – and it may be that multiple ransomware infections have a similar effect, though it
doesn’t seem to be a coordinated strategy.

A Sophos X-Ops Active Adversary Whitepaper August 2022

15

Multiple attackers: A clear and present danger

On the other hand, multiple infections can complicate a ransomware actor’s usual tactics (e.g., they can’t
threaten to leak data if it’s been encrypted by another group⁵³), and a victim faced with a double or even
triple ransom may be more unwilling, or simply unable, to pay all of them. Ransomware groups might reason
that the first to encrypt is more likely to get paid, so on a system with multiple ransomware infections, one
group starting encryption may trigger others to follow suit. That could be one reason for some ransomware
groups boasting about their encryption times.⁵⁴
In our next case study, an organization was hit with three ransomware attacks, two of them within twohours.

Case study: Once, twice, three times encrypted
December 2nd 2021: A threat actor, possibly an IAB, establishes an RDP session on an organization’s domain controller. The
session lasts for 52 minutes.
April 20th 2022: A Lockbit affiliate gains access to the corporate network – likely through the exposed RDP instance,
although, as we’ll explain later, this is hard to determine – and exfiltrates data from four systems to Mega, a cloud storage
service often used by threat actors.
April 28th: The threat actor moves laterally and executes Mimikatz to extract passwords.
May 1st: The threat actor creates two batch scripts to distribute a ransomware binary across the network via the legitimate
tool PsExec.⁵⁵ Ten minutes later, the binary is executed on nineteen hosts, encrypting data, and a ransom note is dropped oneach infected machine.
Less than 2 hours later: A Hive ransomware affiliate – again, probably using RDP for initial access – uses the legitimate tool
PDQ Deploy⁵⁶ to distribute their ransomware binary across the network, using the command C:\Windows\AdminArsenal\
PDQDeployRunner\service-1\exec\windows_x32_encrypt.exe. Around 45 minutes later, the binary is executed,
encrypting data on sixteen hosts.
May 15th: An ALPHV/BlackCat⁵⁷ ransomware affiliate gains access to the network, moves laterally using compromised
credentials, and drops two ransomware binaries. The binaries are distributed across the network using PsExec. Around 30
minutes later, the binaries are executed on six hosts, again encrypting data.
Less than 2 hours later: The ALPHV/BlackCat threat actor clears Windows Event Logs with the command cmd.exe /cfor /F \”tokens=*\” %1 in (‘wevtutil.exe el’) DO wevtutil.exe cl \”%1”\. This action, along with some pre-investigation
remediation actions and peculiarities in the organization’s network configuration, will significantly complicate our incident
response efforts. The BlackCat threat actor not only clears logs relating to their own activities, but also those of the Lockbit
and Hive threat actors, making it difficult to determine the methods used for initial access, lateral movement, and otherevents.
May 15th: The Sophos Rapid Response team is engaged to assist, and observes three separate ransom notes, along withseveral double- and triple-encrypted files.
December 2 2021

Initial access via RDP

April 28 2022

Ransomware

Mimikatz

Ransomware

IAB

LockbitEvent logs cleared

May 15 2022

May 1 2022

Ransomware

Hive

BlackCat/ALPHV

Figure 20: Timeline of the attack

A Sophos X-Ops Active Adversary Whitepaper August 2022

16

Multiple attackers: A clear and present danger

It’s possible that ransomware groups discuss these issues at a senior level – perhaps even working out
mutually beneficial arrangements, so that, for example, when simultaneous infections occur, one groupencrypts while another exfiltrates without encryption.
In fact, we observed exactly this behavior in a case from December 2021,⁵⁸ although we don’t know if it wascoordinated in advance.
First came a Karma ransomware infection via ProxyShell, but data was only exfiltrated, not encrypted (theransom notes claimed that this was because the victim was a healthcare organization; other ransomware
groups have stated they won’t target certain kinds of healthcare businesses at all, as shown below). Then,as Karma ransom notes were still being dropped, along came Conti, via the same vulnerability – who did
encrypt files.

Figure 21: An excerpt from the Lockbit 3.0 affiliate rules, which specifically forbid attacks against “institutions where
damage to the files could lead to death”

Figure 22: The Babuk ransomware group’s rules, which forbid affiliates from attacking various categories oforganizations, including hospitals

Whether they coordinate with each other or not, multiple attacks just don’t seem to be a huge issue forransomware groups. They may even accept it as an occupational hazard – a side effect of operating in an
increasingly crowded and commoditized marketplace.
That said, ransomware actors do sometimes benefit from each other’s activities when they attack the sameorganizations. From what we can tell, this isn’t intentional – at least, not yet – but it does illustrate that
responding to multiple infections can become more complicated for responders and investigators, as well
as victims. In the following incident, a backdoor installed by one threat actor resulted in another attack, fourmonths later.

A Sophos X-Ops Active Adversary Whitepaper August 2022

17

Multiple attackers: A clear and present danger

Case study: Backdoor leads to another attack
January 6th 2022: Multiple attempts to exploit ProxyShell are discovered on an organization’s network. Following initialaccess, a threat actor executes Advanced IP Scanner.
January 19th: The threat actor establishes an RDP connection to a compromised account. Throughout January andFebruary, the threat actor makes several RDP connections and downloads RealVNC.⁵⁹
February 23rd: Two devices on the network communicate with a C2 server over DNS. The threat actor exfiltrates over aterabyte of data to Mega. Over the next few days, the threat actor downloads and installs several legitimate tools, including
WinScp,⁶⁰ an SFTP/FTP client; Rclone,⁶¹ a cloud storage file manager; the compression utility 7-zip;⁶² Putty,⁶³ an SSH and
Telnet client; and AnyDesk,⁶⁴ a remote desktop application. Further RDP connections are established.
March 12th: The threat actor executes AnyDesk, and continues to download and install tools, including AdFind.exe⁶⁵ (anActive Directory query tool); SharpShares⁶⁶ (a binary which lists network share information); lsass_dumper.exe; andNanoDump⁶⁷ (which creates a minidump of the LSASS process). On the same day, the threat actor installs a Cobalt
Strike beacon as a service, and executes a Base64-encoded PowerShell script to download and execute the legitimate
penetration testing tool BloodHound,⁶⁸ used to identify potential attack paths in Active Directory.
March 17th: The threat actor drops and executes a Lockbit ransomware binary.
March 25th: Data from the organization is posted on Lockbit’s leak site.
April 28th: A second threat actor enters the corporative environment via a publicly exposed RDWeb portal. They executerundll32 107s32.dll, StartW, a command commonly used with Cobalt Strike DLLs, and several external connections are
made to a Cobalt Strike staging server. This threat actor also attempts to download and execute BloodHound, but theactivity is blocked.
June 2nd: A third threat actor abuses the previously installed AnyDesk instance to access the network and collect andexfiltrate credentials. They upload some of the organization’s data to dropmefiles[.]com, a file-sharing service. The attack,from initial entry to exfiltration, takes less than fifteen minutes.
June 8th: ‘Karakurt Team’ contacts the organization with a ransom demand. Karakurt (‘Black Wolf’ in Turkish, referring to a
spider found in Eastern Europe and Siberia) typically doesn’t encrypt data, but steals and threatens to release it unless aransom is paid.⁶⁹ Researchers have previously linked Karakurt to the Conti ransomware group.⁷⁰
January 6 2022

ProxyShell exploitation

January 19 2022
RDP access

March 12 2022

Cobalt Strike, BloodHoundTools installed,
including Anydesk

LockbitMarch 25 2022

Data posted to leak site

March 17 2022
Ransomware

June 2 2022

June 8 2022

AnyDesk access

Extortion

April 28 2022
RDWeb access,attack attempt

Unknown

Karakurt

Figure 23: Timeline of the attack

A Sophos X-Ops Active Adversary Whitepaper August 2022

18

Multiple attackers: A clear and present danger

Takeaway 6: Ransomware plays nicely with ransomware
Many threat actors have traditionally been competitive, to the point of kicking each other off infected
systems, and that’s still true today when it comes to cryptominers and some RATs. But ransomware doesn’t
seem to follow this trend, and may proceed to encrypt files even if other ransomware groups are on thesame network – or operate in a mutually beneficial way, so that one group exfiltrates and the other encrypts.

Takeaway 7: Attackers open new backdoors
Some attackers may introduce further vulnerabilities after gaining access, or create deliberate orunintentional backdoors (including the installation of legitimate software), which a subsequent threat actor
can exploit. So while it’s crucial to close off the initial infection vector, it’s also worth considering a) other
weaknesses and misconfigurations that could be used to gain access, and b) any new ingress points that
may have appeared.

Takeaway 8: Some attackers are worse than others
Not all ransomware strains are equal. Some have capabilities and features that may complicate attempts
to respond to and investigate others – another reason to try to avoid becoming a victim of multiple attacks.

A Sophos X-Ops Active Adversary Whitepaper August 2022

19

Multiple attackers: A clear and present danger

Guidance
So, are multiple attacks becoming more common? It’s difficult to say with any statistical certainty, but
anecdotally, signs point to an answer in the affirmative. As Sophos’ Director of Incident Response, Peter
Mackenzie, notes: “This is something we’re seeing affecting more and more organizations, and it’s likely due
to an increasingly crowded market for threat actors, as well as ransomware-as-a-service (RaaS) becoming
more professionalized and lowering the bar to entry.”
As ransomware affiliate programs continue to recruit and expand, and cryptominers continue totake advantage of new vulnerabilities, the number of predators increases – and so do the number ofopportunities.
In general, multiple exploitations are due to the victim not addressing the underlying cause of the initialattack. Other factors driving multiple attacks arise from features of the criminal ecosystem, but there arethings organizations can do to avoid becoming a part of that ecosystem in the first place.
Along with the eight key takeaways we’ve included throughout this article, we recommend the following
standard best practices to help defend against ransomware and related cyberattacks:
1. Patch and investigate. Keep Windows and other software up to date (and consider setting up somevulnerability alerts, and monitoring in-the-know sources, to get a head start on breaking news about
new bugs). This also means double-checking that patches have been installed correctly and are inplace for critical systems like internet-facing machines or domain controllers. However, this isn’t
just a case of applying patches quickly. Threat actors may leave backdoors – which may include theinstallation of legitimate software – or introduce new vulnerabilities, either deliberately or inadvertently,
so this is a key thing for responders to look for to reduce the likelihood of a second attack.
2. Monitor and respond to alerts. Ensure the appropriate tools, processes, and resources(people) are available to monitor, investigate, and respond to threats seen in theenvironment. Ransomware attackers often time their strikes during off-peak hours, on
weekends or during the holidays, on the assumption that few or no staff are watching.
3. Lock down accessible services. Perform scans of your organization’s network from theoutside and identify and lock down the ports commonly used by VNC, RDP, or other remoteaccess tools. If a machine needs to be reachable using a remote management tool, put thattool behind a VPN or zero-trust network access solution that uses MFA as part of its login.
4. Practice segmentation and zero-trust. Separate critical servers from each other and fromworkstations by putting them into separate VLANs as you work towards a zero-trust network model.
5. Set and enforce strong passwords and multifactor authentication (MFA). Strong passwords serve
as one of the first lines of defense. Passwords should be unique or complex and never re-used. Thisis easier to do if you provide staff with a password manager that can store their credentials. But evenstrong passwords can be compromised. Any form of multifactor authentication is better than none forsecuring access to critical resources such as e-mail, remote management tools, and network assets.
6. Inventory your assets and accounts. Unprotected and unpatched devices in the
network increase risk and create a situation where malicious activities could passunnoticed. It is vital to have a current inventory of all connected computers and IoT
devices. Use network scans and physical checks to locate and catalog them.
7. Install layered protection to block attackers at as many points as possible.
Extend that security to all endpoints that you allow onto your network.
8. Configure your products correctly, and check the configurations periodically. Underprotected systems and devices are vulnerable too. It is important that you ensure security
solutions are configured properly and to check and, where necessary, update security
policies regularly. New security features are not always enabled automatically.

A Sophos X-Ops Active Adversary Whitepaper August 2022

20

Multiple attackers: A clear and present danger

Acknowledgments
Sophos X-Ops would like to thank Hilary Wood and Colin Cowie of Sophos’ Managed Detection and Response
team; Syed Shahram Ahmed and Mauricio Valdivieso of Sophos’ Rapid Response team; and Andrew Ludgate
and Gabor Szappanos of SophosLabs, for their contributions to this report.

References

1 https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/

aa65e05-2a44-4dd3-be3d-6dbb06cc94ad&CommunityKey=1ecf5f559545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments

2 https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomwareactors-use-confluence-exploit-dll-side-load-for-stealthy-attack/38 https://www.sophos.com/fr-fr/medialibrary/PDFs/technical-papers/
Sophos-what-is-zeus-tp.pdf

3 https://documents.trendmicro.com/assets/white_papers/wp-navigatingthe-landscape-of-cloud-based-cryptocurrency-mining.pdf

39 https://krebsonsecurity.com/2010/10/spyeye-v-zeus-rivalry-ends-inquiet-merger/

4 https://nvd.nist.gov/vuln/detail/CVE-2021-26855

40 https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp

5 https://nvd.nist.gov/vuln/detail/CVE-2021-34473

41 https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/follina-msdt-exploit-malware

6 https://nvd.nist.gov/vuln/detail/CVE-2021-34523
7 https://nvd.nist.gov/vuln/detail/cve-2021-31207
8 https://news.sophos.com/en-us/2021/03/17/MDR-in-real-time-exchangeproxylogon-edition/
9 https://news.sophos.com/en-us/2021/08/23/proxyshell-vulnerabilities-inmicrosoft-exchange-what-to-do/
10 https://news.sophos.com/en-us/2021/05/07/new-lemon-duck-variantsexploiting-microsoft-exchange-server/
11 https://news.sophos.com/en-us/2021/12/02/two-flavors-of-tor2mineminer-dig-deep-into-networks-with-powershell-vbscript/
12 https://news.sophos.com/en-us/2022/02/15/vulnerable-exchange-server-hit-by-squirrelwaffle-and-financial-fraud/
13 https://news.sophos.com/en-us/2021/03/15/dearcry-ransomwareattacks-exploit-exchange-server-vulnerabilities/
14 https://news.sophos.com/en-us/2021/03/23/black-kingdom/
15 https://news.sophos.com/en-us/2021/08/27/lockfile-ransomwares-boxof-tricks-intermittent-encryption-and-evasion/
16 https://news.sophos.com/en-us/2022/02/28/conti-and-karma-actorsattack-healthcare-provider-at-same-time-through-proxyshell-exploits/
17 https://nvd.nist.gov/vuln/detail/CVE-2021-44228
18 https://news.sophos.com/en-us/2022/01/24/log4shell-no-mass-abusebut-no-respite-what-happened/
19 https://news.sophos.com/en-us/2022/03/29/horde-of-miner-bots-andbackdoors-leveraged-log4j-to-attack-vmware-horizon-servers/
20 https://news.sophos.com/en-us/2022/06/16/confluence-exploits-usedto-drop-ransomware-on-vulnerable-servers/
21 https://nvd.nist.gov/vuln/detail/CVE-2022-26134
22 https://www.computerweekly.com/news/252510662/2021-anotherrecord-breaker-for-vulnerability-disclosure
23 https://bugalert.org/
24 https://cvetrends.com/
25 https://www.advanced-ip-scanner.com/
26 https://github.com/gentilkiwi/mimikatz
27 https://www.cobaltstrike.com/
28 https://ke-la.com/access-as-a-service-remote-access-markets-in-thecybercrime-underground/

42 https://news.sophos.com/en-us/2022/05/30/follina-word-doc-tapspreviously-unknown-microsoft-office-vulnerability/
43 https://nvd.nist.gov/vuln/detail/CVE-2022-30190
44 https://jfrog.com/blog/malware-civil-war-malicious-npm-packagestargeting-malware-authors/
45 https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/
sophos-cyberthreats-20-year-retrospective-wp.pdf
46 https://docs.microsoft.com/en-us/troubleshoot/windows-server/securityand-malware/blaster-worm-virus-alert
47 https://www.youtube.com/watch?v=SrVeLNGcbBE
48 https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/
sophos-labs-kingminer-botnet-report.pdf
49 https://www.techtarget.com/searchsecurity/news/252512902/Distrustfeuds-building-among-ransomware-groups
50 https://www.secureworks.com/research/lv-ransomware
51 https://nakedsecurity.sophos.com/2020/05/12/maze-ransomware-oneyear-on-a-sophoslabs-report/
52 https://www.documentcloud.org/documents/20428892-doppelpaymerfbi-pin-on-dec-10-2020
53 https://news.sophos.com/en-us/2021/08/11/ransomware-mishapsadversaries-have-their-off-days-too/
54 https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.
html
55 https://docs.microsoft.com/en-us/sysinternals/downloads/psexec
56 https://www.pdq.com/deploy/
57 https://news.sophos.com/en-us/2022/07/14/blackcat-ransomwareattacks-not-merely-a-byproduct-of-bad-luck/
58 https://news.sophos.com/en-us/2022/02/28/conti-and-karma-actorsattack-healthcare-provider-at-same-time-through-proxyshell-exploits/
59 https://www.realvnc.com/en/
60 https://winscp.net/eng/index.php
61 https://rclone.org/
62 https://www.7-zip.org/
63 https://www.putty.org/

29 https://s3.amazonaws.com/talos-intelligence-site/production/document_
files/files/000/095/787/original/ransomware-chats.pdf

64 https://anydesk.com/

30 https://docs.microsoft.com/en-us/visualstudio/msbuild/
msbuild?view=vs-2022

66 https://github.com/djhohnstein/SharpShares

31 https://twitter.com/GossiTheDog/status/1541688001620754436

68 https://github.com/BloodHoundAD/BloodHound

32 https://twitter.com/vxunderground/status/1544306201600598016
33 https://twitter.com/vxunderground/status/1544306201600598016
34 https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/
sophos-cyberthreats-20-year-retrospective-wp.pdf

65 http://www.joeware.net/freetools/tools/adfind/index.htm
67 https://github.com/helpsystems/nanodump
69 https://www.cisa.gov/uscert/ncas/alerts/aa22-152a
70 https://www.infinitumit.com.tr/conti-ransomware-group-behind-thekarakurt-ha

35 http://news.bbc.co.uk/1/hi/technology/3532009.stm
36 https://nakedsecurity.sophos.com/2012/01/05/spyeye-bank-trojanhides-its-fraud-footprint/
37 https://community.broadcom.com/symantecenterprise/communities/
community-home/librarydocuments/viewdocument?DocumentKey=6

A Sophos X-Ops Active Adversary Whitepaper August 2022

21

Multiple attackers: A clear and present danger

United Kingdom and Worldwide Sales
Tel: +44 (0)8447 671131
Email: sales@sophos.com

North American Sales
Toll Free: 1-866-866-2802
Email: nasales@sophos.com© Copyright 2022. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2022-08-01 EN (DD)

Australia and New Zealand Sales
Tel: +61 2 9409 9100
Email: sales@sophos.com.au

Asia Sales
Tel: +65 62244168
Email: salesasia@sophos.com