TTP Tuesday: Ransomware (Release 4)

Linux Ransomware using Custom Tools

Theme Overview

Our current theme is ransomware, focusing on scenarios where threats use live off the land (LotL) binaries and custom payloads to accomplish their objectives. The ransomware theme will contain the following kill-chains:

1. Linux Ransomware using Live off the Land (LotL) Tools
2. Windows Ransomware using Live off the Land (LotL) Tools
3. MacOS Ransomware using Custom Tools
4. Linux Ransomware using Custom Tools (Current Release)

Linux Ransomware using Custom Tools - C(S)wipe

We were originally shooting to release a Windows variant of S(C)wipe but ran into compiling restraints right up to the release of this chain, so we opted to compile for Linux. We’ll release a Windows variant of this chain later on.

This week’s kill chain focuses on a different approach to ransomware for Linux machines. Instead of relying on a typical “discover and encrypt” attack path, our custom chain, written in C, delivers a (safe) attack that:

• Takes a directory and reads (1-level) of files
• Once the important directories are located, a custom payload drops on those directories and connects to a unique server (Spiderweb).
• That connection exfiltrates each file found within those directories to the web server (Spiderweb).
• Once exfiltrated, the contents of each of the files are replaced with a ransom note.

The purpose of this chain is to deliver a ransomware attack without using a traditional encryption method, therefore becoming harder to detect and presenting an alternative method to a current potential “blind spot” in defenses.

We have designed this chain with two paths, one safe* and one *destructive*. The safe path (the default) will copy each file before wiping and apply the wipe to the copy only. Removing the *safe* flag will allow this attack to run in the wild, and will be *destructive.

Watch a demonstration: Linux Custom Ransomware

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: privateducky
Alex: khyberspache
Kris: Xanthonus
Octavia: VVX7
Sam: wasupwithuman