Flash Notice: LockBit 2.0 - FBI Releases New IoCs for Ransomware Attacks

Overview

In September 2021, Avertium published a threat intelligence report featuring ransomware gang, LockBit 2.0, which is a variant of the original LockBit ransomware gang. LockBit 2.0 uses ransomware-as-a-service (RaaS) and has been active in Russian-language cybercrime forums since September 2021.

In their previous attacks, LockBit 2.0 relied on tools such as Windows PowerShell and Server Message Block (SMB) to attack organizations – scanning networks to infect compromised devices. Also, the threat actor used tools that were built-in to Windows systems - sometimes called Living off the Land Binaries, or LoLBins. They also used the double extortion model, which involves locating and exfiltrating sensitive and confidential information before a system is encrypted – ensuring that the stolen data gives victims an incentive to pay the requested ransom.

On Friday, February 4, 2022, the FBI released technical details and new indicators of compromise associated with LockBit 2.0. The threat actors successfully breach enterprise networks by compromising them through unpatched vulnerabilities, zero-day exploits, and insider access. They are also known to purchase access to networks from “access brokers”.

Once inside the networks, LockBit 2.0 uses publicly available penetration-testing tools (Mimikatz) for privilege escalation. They have been using a combination of custom and off-the shelf tools to exfiltrate data, before using the LockBit ransomware to encrypt files. In January 2022, LockBit 2.0 began targeting VMware ESXi servers by adding a Linux encryptor to their toolkit.

Before encryption, Lockbit 2.0 affiliates use Stealbit (obtained from the LockBit panel) to exfiltrate specific file types. This allows the attackers to configure the desired file types that will be copied to an attacker-controlled server over HTTP. Additionally, LockBit 2.0 deletes shadow copies and log files, harvests system information and encrypts all data on local and remote drives. It skips files used for core system functions and deletes itself from the disk - creating persistence at startup. So far, LockBit 2.0 has claimed to have successfully attack PayBito. They stole the data of about 100,000 customers and have threatened to publish the data online if their ransom isn’t paid by February 21, 2022.

Related Resource: A Comprehensive Guide to Ransomware

How Avertium is Protecting Our Customers:

Implement XDR as a prevention method. Our XDR is a combination of monitoring software like LogRhythm, Microsoft Sentinel, or AlienVault, combined with endpoint protection such as SentinelOne. XDR platforms enable cybersecurity through a technology focus by collecting, correlating, and analyzing event data from any source on the network. This includes endpoints, applications, network devices, and user interactions.
Include a Zero Trust Architecture, like AppGate, to stop malware lateral movement.
MDR provides an in-depth investigation into potential threats on an organization’s network. Avertium’s risk-based approach to managed security delivers the right combination of technology, field-validated threat intelligence, and resource empowerment to reduce complexity, streamline operations, and enhance cybersecurity resilience. If you need a more advanced security solution, MDR is the next step. MDR is an outsourced security control solution that includes the elements of EDR, enhanced with a range of fundamental security processes.

Avertium's recommendations

It’s likely that LockBit 2.0 monitors the latest CVEs. Monitor exposed endpoints and application of CVE-addressing patches.
Disrupt network movements/investigation by way of creating separated segments of network, clear access hierarchy, and additional security for active directory, domain admin, and local domains – thus complicating LockBit 2.0’s operations.
Enable MFA for webmail
Use strong and unique passwords
Monitor infrastructural endpoints for public-facing applications. LockBit 2.0 prefers Corporate VPN (particularly Citrix/FortiNET) LockBit 2.0 is known for actively exploiting public-facing applications.
Use a host-based firewall
Enable “protected files” in Windows (refer to Microsoft’s controlled folder access)
Segment your networks
Maintain offline backups of data