Cyber Security Threat Summary:
An unknown threat actor is using a variant of the Yashma ransomware to target various entities in English-speaking countries, Bulgaria, China, and Vietnam at least since June 4, 2023. Cisco Talos, in a new write-up, attributed the operation with moderate confidence to an adversary of likely Vietnamese origin. ‘The threat actor uses an uncommon technique to deliver the ransom note’ security researcher Chetan Raghuprasad said. ‘Instead of embedding the ransom note strings in the binary, they download the ransom note from the actor-controlled GitHub repository by executing an embedded batch file.’ A notable aspect of the ransom note is its resemblance to the well-known WannaCry ransomware, possibly done so in an attempt to obscure the threat actor's identity and confuse attribution efforts. While the note mentions a wallet address to which the payment is to be made, it doesn't specify the amount.

Security Officer Comments:
First spotted in May 2022, Yashma is a 32-bit executable written in .NET that was developed based on another ransomware strain called Chaos, which had its builder leaked in the wild. As noted above, the new variant executes an embedded batch file, which will fetch and download the ransom note from a GitHub repository. Researchers note this modification was made to evade endpoint detection and anti-virus solutions, which are designed to detect embedded ransom note strings in binaries. Taking a look at the latest variant, the ransomware establishes persistence in the targeted system’s Run registry key by dropping a Windows shortcut file pointing to the ransomware executable path in the startup folder. Furthermore, to make recovery difficult, the Yashma variant will wipe the contents of the original unencrypted files, write a single character “?”, and proceed to delete the files.

Suggested Correction(s):
Backup your data, system images, and configurations, regularly test them, and keep the backups offline: Ensure that backups are regularly tested and that they are not connected to the business network, as many ransomware variants try to find and encrypt or delete accessible backups. Maintaining current backups offline is critical because if your network data is encrypted with ransomware, your organization can restore systems.

Update and patch systems promptly: This includes maintaining the security of operating systems, applications, and firmware in a timely manner. Consider using a centralized patch management system; use a risk- based assessment strategy to drive your patch management program.

Test your incident response plan: There's nothing that shows the gaps in plans more than testing them. Run through some core questions and use those to build an incident response plan: Are you able to sustain business operations without access to certain systems? For how long? Would you turn off your manufacturing operations if business systems such as billing were offline?

Check Your Security Team's Work: Use a 3rd party pen tester to test the security of your systems and your ability to defend against a sophisticated attack. Many ransomware criminals are aggressive and sophisticated and will find the equivalent of unlocked doors.

Segment your networks: There's been a recent shift in ransomware attacks – from stealing data to disrupting operations. It's critically important that your corporate business functions and manufacturing/production operations are separated and that you carefully filter and limit internet access to operational networks, identify links between these networks and develop workarounds or manual controls to ensure ICS networks can be isolated and continue operating if your corporate network is compromised. Regularly test contingency plans such as manual controls so that safety critical functions can be maintained during a cyber incident.

Train employees: Email remains the most vulnerable attack vector for organizations. Users should be trained how to avoid and spot phishing emails. Multi Factor authentication can help prevent malicious access to sensitive services.

Link(s):
https://thehackernews.com/2023/08/new-yashma-ransomware-variant-targets.html