The recently learned Linux-Based ransomware pressure acknowledged as Cheerscrypt has been attributed to a Chinese cyber espionage team regarded for working short-lived ransomware techniques.
Cybersecurity agency Sygnia attributed the assaults to a menace actor it tracks below the name Emperor Dragonfly, which is also recognised as Bronze Starlight (Secureworks) and DEV-0401 (Microsoft).
Use of Cheerscrypt
Cheerscrypt was first analyzed by Trend Micro in May 2022, like other ransomware families employed by the APT group, the Cheerscrypt ransomware encryptor was also created from the code of Babuk ransomware which was leaked online in June 2021.
The use of Cheerscrypt is the hottest addition to a extended list of ransomware family members beforehand deployed by the team in minor more than a year, which includes LockFile, Atom Silo, Rook, Evening Sky, Pandora, and LockBit 2..
The attackers also delivered three Go-based tools along with the beacon, a keylogger that upload the keystrokes to Alibaba Cloud, a customized version of the internet proxy utility called iox, and the tunneling software NPS.
The attackers used the Impacket open-source tool to perform reconnaissance activities and make lateral movements withing the target network.
The menace actor’s modus operandi further stands out for its handling of all stages of the ransomware attack lifecycle.
Cheerscrypt’s links to Emperor Dragonfly similarities in preliminary entry vectors, lateral motion approaches, and the deployment of the encrypted Cobalt Strike beacon by means of DLL side-loading.
- Identify and patch critical vulnerabilities.
- Limit outbound internet access from servers.
- Protect the virtualization platform.
- Limit lateral movement through the network.
- Protect privileged accounts.
|37011eed9de6a90f3be3e1cbba6c5ab2||Encrypted Cobalt Strike payload||C:\Windows\Help\OEM\ContentStore\vlcplayer.dat|
|240118f6205effcb3a12455a81cfb1c7||Weaponized DLL loaded by FCAuth.exe||C:\Windows\Help\Corporate\utilsdll.dll|
|e5fd4d5774ad97e5c04b69deae33dc9e||Weaponized DLL loaded by mfeann.exe||C:\Windows\debug\LockDown.dll|
|2893d476408e23b7e8a65c6898fe43fa||Encrypted Cobalt Strike payload||C:\Windows\Help\Corporate\auth.dat|
|8161d8339411ddd6d99d54d3aefa2943||Encrypted Cobalt Strike payload||C:\Windows\debug\debug.dat|
|5a852305ffb7b5abeb39fcb9a37122ff||Weaponized DLL loaded by vlc.exe||C:\Windows\Help\Corporate\libvlc.dll|
|f0656e3a70ab0a10f8d054149f12c935||Encrypted Cobalt Strike payload||C:\Windows\Help\Corporate\auth.dat|
|37011eed9de6a90f3be3e1cbba6c5ab2||Encrypted Cobalt Strike payload||C:\Windows\Help\Corporate\vlcplayer.dat|
|139[.]180[.]217[.]203||C&C server (Cobalt Strike Beacon was downloaded from this IP)|
|178[.]128[.]102[.]13||Cobalt Strike C&C server|
|139[.]59[.]243[.]219||Cobalt Strike C&C server|