Localization of Ransomware,
New Change or Temporary
Phenomenon?
- Characteristics and Techniques of Active Ransomware Gangs inKorea
CHA Minseok (Jacky Cha, 車珉錫)
Senior Principal Threat Intelligence ResearcherThreat Intelligence Team | ASECJSAC 2023 (January 26, 2023)

:~$whoami• CHA Minseok(Jacky Cha, 車珉錫)
- Senior Principal Threat Intelligence Researcher at AhnLab- Joined AhnLab in 1997 (25+ years of experience in Anti-Virus technologies)- ICT Cyber Expert Group in Korea, Former AVAR (Association of Anti-Virus Asia Researchers) Director, Former WildList Reporter- Speaker at AVAR, AVTOKYO, CARO Workshop, CODE BLUE, HITB GSEC Commsec, JSAC, SECUINSIDE and Virus Bulletin- Enjoys old video games (Apple ][, Atari 8 bit, Commodore 64, MSX, MS-DOS) and old Anime2

Table of Contents
1 Recent Ransomware Trends
2 Localization of Ransomware?
3 Case Study: Republic of Korea
4 Characteristics of Targeted Ransomware (in Korea)

5 Outlook of Ransomware Localization
6 Conclusion

1Recent Ransomware Trends

Ransomware• Ransomware- Greatest concern for customers- RaaS (Ransomware as a Service)- Targeted attack- Recovery Tool: Securing ransomware bug and key* Source: https://www.bbc.com/news/business-64244121, https://www.healthcareitnews.com/news/asia/osaka-hospital-hit-ransomware-report5Recent Ransomware Trends• Characteristics of Recent Ransomware- Target : Individuals or companies (Targeted attack)- RaaS (Ransomware as a Service) : Emergence of local partners. Localized attack attempts- Certain targets excluded from attacks (Medical Institution, Critical Infrastructure) – Some Ransomware Gangs* Source: https://www.bleepingcomputer.com/news/security/ransomware-gang-apologizes-gives-sickkids-hospital-free-decryptor/- Attack Vectors : Email, Server Vulnerability -> Distributed using company environment (Management Software)- Emergence of Wipers disguised as ransomware- Ransomware development by nationally supported Threat Actors- Localization?

6

2
Localization of Ransomware?

Localization of Ransomware• Localization of Ransomware- Due to the differences in language, culture, environment, and habits, threat actors use various methods of attacks
according to region and language- Language : attacks used emails written in local language- Not active in certain regions in order to avoid being tracked by the legal authorities in those areas- Add Local Program Extension (local word processor), Bypass Local AntiMalware(Exclude specific Path, Bait Files)- Ransomware active in certain regions discovered (Korea, Taiwan)* Source: https://www.trendmicro.com/en_us/research/20/e/targeted-ransomware-attack-hits-taiwanese-organizations.html
8

Regionally Active Ransomware• Region-specific active ransomware- ARCrypter(ChileLockeR): Chile -> Canada, China- Cheers: Japan- Gwisin, Masscan: South Korea- Lorenz: US- Stormous: Vietnam- Sparta Blog: Spain- ColdLock: Taiwan* Source: https://www.dragos.com/blog/industry-news/dragos-industrial-ransomware-analysis-q3-2022/
9

Regionally Active Ransomware• Regionally active ransomware-Gwisin, Masscan
Sparta BlogLorenz

CheersColdLockStormous

ArCrypter(ChileLocker)* Source: https://www.traveltip.org/countries_visited.php
103Case Study: Republic of Korea

Ransomware Timeline in Korea• Timeline- 2010: Ransomware infection through a certain messenger program -> Financial sector infected- 2011: Discovery of Korean version of Ransomware using translator- 2015: Cryptolocker infection through a famous IT website -> First large-scale damage- 2016: VenusLocker ransomware attacks with emails written in Korean discovered -> Serious damage- 2017: A web hosting company suffers damage from Erebus ransomware- 2017: Magniber ransomware targeting Korean users discovered- 2018: Emergence of the GandCrab ransomware which targeted Korea- 2019: Companies attacked by Clop ransomware- 2019: Smaller companies attacked with files such as fake job applications- 2021: New Emergence of ransomware only active in Korea

12

Ransomware Attack Timeline• Ransomware attack cases (2021-2022)
DateRansomware

Nov 2021

HiveFeb 2022

HiveApr 2022

GwisinJuly 2022

MasscanJuly 2022

GwisinJuly 2022

LockBit 3.0

July 2022

Bluecrab (Sodinokibi)

July 2022

BitLocker

July 2022

Hive

July 2022

Masscan

Aug 202
2

BitLocker

Dec 2022

Cuba

13

Attackers - Venus IAB (Initial Access Brokers)• Venus IAB- First emerged in late 2016
- Fluent Korean (everyday expressions, profanities, etc.): Native Korean or fluent Korean speaker- Attacks involved emails disguised as internal guidelines, lawsuits, training schedules, traffic fines, copyright
infringements, job recruitment ads, etc.
- Used a compressed file extension (EGG) that is used in Korea- Utilized various ransomware: VenusLocker -> Auto Cryptor -> GandCrab -> Sodinokibi -> Nemty -> Makop -> LockBit 3.0- Distributed CoinMiner• Questionable points- String within LNK file: VenusLocker_Korean.exe- SimSun (Chinese Font): ????

14

Attackers - Magniber Ransomware• Magniber Ransomware- First discovered in Oct 2017
- Targeting Korea? Some variants only active on Korean Windows and Korean IP addresses- Distributed using typosquatting- Fileless format -> Distributed with file extensions such as MSI, CPL, JSE, JS, WSF, etc.
- Attacked Japan and Taiwan. Hit France, Germany, Italy in 2023

* Source: https://asec.ahnlab.com/en/44315/, https://twitter.com/AvastThreatLabs/status/1613248553626787842

15

Attackers - GandCrab (Bluecrab) IAB• GandCrab Ransomware IAB- Discovered in Korea in February 2018- Initially, attacks were done through machine-translated emails withbroken Korean- Added the HWP (Hancom Word Processor) file extension as anencryption target- Speculated to be a local partner- Cases where only users in Korea were infected through IP scans• GandCrab Ransomware distributor apprehended- In February 2021, the suspect that impersonated the police andDisguised as Police

distributed GandCrab Ransomware was apprehended- In February 2019, 6,486 emails claiming to be from the police weresent- Received by the developer -> 7% of the profit sent to the distributor

via a broker -> 12 million won (1,265,000 Yen) profit* Source: https://www.korea.kr/news/pressReleaseView.do?newsId=156440086
16

Attackers - Gwisin Ransomware• Gwisin Ransomware- Taking its name from ‘귀신’(鬼神, kwiɕin ), a Korean term for ‘Ghost’ or ‘Spirit’- After first being discovered in Sept 2021, it was only covered on the news until the spring of 2022 before relevant
information was released in July 2022

- Windows and Linux versions- Targeted ransomware that includes the victim in the ransom note -> Limits information sharing among security

companies- The Windows version is distributed as an MSI file while the actual ransomware is an encrypted Binary.helper file

- The Windows version requires additional values such as SERIAL, LICENSE, SMM and ORG to be executed -> Cannot beexecuted only with samples- After leaking information, related details are included in the ransom note -> Speculated to be a fluent Korean speaker17

Attackers - Masscan Ransomware• Masscan Ransomware- First discovered in Apr 2022
- According to KISA, Masscan took up 64% of the 58 reported ransomware that targeted database servers until Sept 2022

- Circumstantial cases in the US, Vietnam, and Czech Republic- Attacks vulnerable DB servers- Encryptor and decryptor are the same files- Has a configuration file (not retained)- Masscan extension added after file encryption- Encrypts the shared network folder- Operation MaRS: Masscan Ransomware Threat Analysis Report18

Attackers - Unclassified Ransomware• Unreported variants? Unconfirmed variants?

• Ransomware difficult to attribute- Email address within the ransom note -> Same information as MedusaLocker -> The malware is not MedusaLocker but

another ransomware* Source: https://www.cisa.gov/uscert/ncas/alerts/aa22-181a- Similar ransomware but with a different ransom note -> Order-made ransomware?
• Ransomware creation service?
- Multiple similar ransomware with different ransom notes exist
19

Attackers – Government-Sponsored Threat Actor• Andariel Group- Kaspersky revealed that the Andariel Group performed attacks using ransomware- Sample received from the customer in Sept 2020 (Actual damages were unconfirmed)- In July 2022, a Maui Ransomware attack wasreported in the US- No cases of Maui Ransomware activities confirmed

in Korea• Kimsuky Group- The Korean police force presented its

North Korean hacking organization email address

investigation results in Dec 2022
- Encrypted 13 shopping mall company servers
before requesting cryptocurrency- Individuals trying to earn pocket money?

Cryptocurrency demand* Source: https://www.youtube.com/watch?v=vVC067aGEkk20

Attackers – Computer Repair• Computer repairmen who made and distributed ransomware- 9 people were charged for infecting clients with ransomware after being requested for services such as data recovery- Remote control malware installed on the computers of about 20 companies during on-site repairs -> Ransomware
infection -> Recovery request- Appropriated about 360 million won (37,900,000 Yen) from 40 victims* Source: https://therecord.media/south-korean-police-arrest-computer-repairmen-who-made-and-distributed-ransomware/
21

Negotiation Agencies• Ransomware negotiation agencies- Search for "Ransomware Recovery" on Korean portal websites returns ads for negotiation agencies- Negotiation services and Forensics: Negotiation agencies make more profit

22

4

Characteristics ofTargeted Ransomware (in Korea)

Corporation Attack Vectors
Supply Chain / IT Maintenance Services

UpdateServerSend file transfer
commands

ServerWeb
Server

Watering hole

Vulnerability
AttackLateral Movement(Port Scanning,Vulnerability Attacks)

Email(Spear Phishing)

C&C

VPN, Remote
Credential24

Bypass AntiMalware• Disablement and evasion of Endpoint Security Product- Attempts to uninstall- Prompts users to uninstall- Turns off Real Time Protection- Adds to Whitelist- Uses loaders• Case of evasion using loaders- First Attemp : Blocked by AntiMalware Real Time Protection- Second Attemp : Blocked by AntiMalware Behavior-based Protection- Third Attemp : Loaded and executed the encrypted ransomware memory using a loader -> Success25

5

Outlook ofRansomware Localization

Outlook• Ransomware Localization (Pros)- Participation in ransomware from criminal organizations in each country- Ransomware created not only for financial gains but also for political gains• Ransomware Localization (Cons)- Temporary phenomenon: Desire activity in various regions- Possibility of ransomware being active in other countries but undetected• Outlook- Local ransomware gangs can spread to nearby countries -> High possibility of becoming active in specific languages,cultures, and regions- Local research: language, IT environment, security products, backups …

27

6Conclusion

Conclusion• Changes in ransomware- RaaS, Targeted Attack• Ransomware localization- Emergence of ransomware active in certain regions• Cases in the Republic of Korea- Local ransomware and IAB activities- Types that cannot be classified into existing ransomware categories (Insufficient information?)• Endpoint Security- Limit user permissions to change settings- Faulty endpoint security product identification needed• Interest in cases from other countries- Attackers sometimes start in one region and expand to neighboring countries- Information sharing regarding attack vectors, threat actors, and ransomware needed29

Contact

Thank you for your attention!
CHA Minseok (Jacky)• minseok.cha@ahnlab.com• mstoned7@gmail.com•@mstoned730

Reference• Gwisin Ransomware Targeting Korean Companies ( https://asec.ahnlab.com/en/37483/ )• TTPs #8 Operation GWISIN - Analysis on Fully Customized Ransomware Attack Strategies( https://www.boho.or.kr/krcert/publicationView.do?bulletin_writing_sequence=66955 )• Masscan Ransomware Threat Analysis ( https://www.fsec.or.kr/bbs/detail?menuNo=1006&bbsNo=11181 )

31