Intruder Deploys Medusa Unlocker instead of Medusa Locker in Attempted Medusa Ransomware Operation Targeting eSentire Legal Customer

Recently, a hands-on intruder immediately began to attempt lateral movement and gain credential access upon successful abuse of compromised RDP credentials at a legal firm that is an eSentire MDR customer.

After performing initial network discovery with Advanced IP Scanner and PC Hunter (tool that allows kernel manipulations and terminate processes), the intruder deployed mimikatz and attempted to move laterally to five hosts within the network.

Of the five hosts, four were adequately protected and sent security alerts to eSentire‘s 24/7 Security Operations Center (SOC). However, the fifth host was outside of endpoint monitoring scope and the threat actor was able to successfully compromise it.

The threat actor‘s ability to move laterally resulted in them accessing an endpoint-protected host, which resulted in the escalation of the incident to Incident Handlers and eSentire’s Threat Response Unit (TRU). Without endpoint telemetry for the compromised hosts, investigators pivoted to network and log data to pinpoint the cyberattack.

By the time the hands-on attacker was engaged and ejected from the legal firm‘s internal environment, they had attempted to deploy MedusaLocker, but ultimately failed in the deployment.

Analysis of the deployed payload showed that the actor had accidentally deployed the Medusa Unlocker – the decrypter (Figure 1) – instead of the actual ransomware, MedusaLocker (MD5: 908e3b6aab0126ef4efcdc8c4805abd7) (Figure 2). It‘s likely this occurred due to the similarity in names.

Toolset and Tactics

As is typical of ransomware intrusion today, the intruder leveraged Cobalt Strike to deploy and manage tools and C2, including mimikatz, to gain credential access for network discovery and lateral movement (Figure 3). The toolset has some overlap with intruders observed deploying ALPHV or BlackCat ransomware.

060c523563e6d33bc8d0576aa18cf835ecac460c9980246e055508f980e14f9b - Medusa Unlocker - c:\users\prolaw\pictures\64\56771.exe
ca5952b6e5d4aeb9263afe91b3524ac9cc654b88a7c90b41ec75e3506c6aa570 - webbrowserpassview.exe
ad6b98c01ee849874e4b4502c3d7853196f6044240d3271e4ab3fc6e3c08e9a4 - psexec64.exe 
3337e3875b05e0bfba69ab926532e3f179e8cfbf162ebb60ce58a0281437a7ef - psexec.exe
6a87226ed5cca8e072507d6c24289c57757dd96177f329a00b00e40427a1d473 - netpass (1).exe
6d924d92e3084190ed4bb9fed5435f5280f738e5842b8bb3fa6df5f408d2009d - pchunter64_s.exe
0ad926fa666acba562446f68c77199b5b2dc79b68245a04e3b6efd2a88ceae9a - pchunter64_у1.exe
8846c8be509a4b274d6d1465e9cc14d44cfb0a51f917d3a00ce00fa0b35a4284 - mimikatz.dll
bee3d0ac0967389571ea8e3a8c0502306b3dbf009e8155f00a2829417ac079fc - mimidrv.sys
d9770865ea739a8f1702a2651538f4f4de2d92888d188d8ace2c79936f9c2688 - mimilib.dll
96632f716df30af567da00d3624e245d162d0a05ac4b4e7cbadf63f04ca8d3da - mimispool.dll

Figure 3: Tools deployed to compromised endpoints

Infrastructure Analysis

The C2 infrastructure leveraged by the threat actor was a Windows Virtual Private Service (VPS) with RDP and WinRM open (Figure 4) bearing self-signed certs with the hostname: RUTHERFORD. Windows RDP configurations for C2 have been observed before, leveraged by various affiliates deploying ransomware – notably Diavol, Conti, and Lockbit.

In some cases, threat actors are able to register these machines with the victim organization‘s network, leveraging Cobalt Strike as a reverse proxy since the machine names can sometimes be tracked. For example, the system name WIN-LIVFRVQFMKO appeared in a similar incident intercepted by TRU in Summer 2022. The system name also appeared in Conti leaks chat and a LockBit ransomware incident. These re-used hostnames could be the result of malicious infrastructure providers, such as Deep Cack and vps_crack_team, helping their customers by avoiding individual identifiers.

In the case of MedusaLocker, the machine name choice, RUTHERFORD, was likely an artifact of the Virtual Private Service (VPS) provider the hackers used. Selectel, a Russian based IT infrastructure provider supports RDP Windows machines and uses naming conventions of historical physicists and mathematicians for their hostnames, such as RUTHERFORD , NEWTON, HILBERT, and LOBACHEVSKY.

Although it's not yet known why Selectel does not use an individual naming scheme for leased RDP infrastructure, the end result is the same as malicious infrastructure providers – uniquely identifying infrastructure use becomes more complex.

Recommendations from TRU to Protect Your Organization from This Cyber Threat

As the adversarial TTPs grow in sophistication, they lead to a certain level of difficulty at which critical business decisions must be made. Preventing the various attack paths utilized by modern threat actors requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions. To increase your resilience against cyber threats like this, we recommend:

1. Endpoint monitoring: Deploy an Endpoint Detection and Response solution for 24/7 endpoint monitoring to workstations, ensure the endpoints leverage rules around User Execution and Windows Proxy Execution. When managed properly, endpoint monitoring can detect many initial access attacks and most post-compromise actions such as network discovery, credential access, and lateral movement.
   • In this specific case, if the endpoint where the initial access occured had endpoint detection implemented, this incident would have very likely not happened.
2. Leveraging solutions like VPNs, MFA, and firewalls: Machines with RDP open (3389) to the internet are a risk and should be adequately covered with additional protections:
   • VPN: Ensure internet-facing machines are behind a Virtual Private Network.
   • MFA: Ensure all your systems are up-to-date with Multi-Factor Authentication (MFA) in place.
   • Firewall: Consider firewall rules that only allow particular ranges for RDP traffic.
3. Managing your inventory effectively: Ensure you‘re keeping track of your inventory and your cybersecurity posture with respect to the current threat landscape.
4. Leveraging threat intelligence capabilities: To keep track of what cybercriminals are doing, the TTPs used, and emerging cyber threats, you‘ll need highly-skilled staff that can correlate and enrich intelligence extracted from daily threat investigations and multiple third-party sources.

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire cybersecurity specialist.