A brand new ransomware-as-a-service (RaaS) operation named Cicada3301 has already listed 19 victims on its extortion portal, because it rapidly attacked corporations worldwide.
The brand new cybercrime operation is known as after the mysterious 2012-2014 on-line/real-world sport that concerned elaborate cryptographic puzzles and used the identical brand for promotion on cybercrime boards. Nevertheless, it’s unlikely there is a connection between the 2.
The Cicada3301 RaaS first started selling the operation and recruiting associates on June 29, 2024, in a discussion board put up to the ransomware and cybercrime discussion board often known as RAMP.
Nevertheless, BleepingComputer is conscious of Cicada assaults as early as June 6, indicating that the gang was working independently earlier than making an attempt to recruit associates.
Supply: Truesec
Like different ransomware operations, Cicada3301 conducts double-extortion ways the place they breach company networks, steal knowledge, after which encrypt units. The encryption key and threats to leak stolen knowledge are then used as leverage to scare victims into paying a ransom.
The menace actors function an information leak website that’s used as a part of their double-extortion scheme.
Supply: BleepingComputer
An evaluation of the brand new malware by Truesec revealed important overlaps between Cicada3301 and ALPHV/BlackCat, indicating a attainable rebrand or a fork created by former ALPHV’s core crew members.
That is primarily based on the truth that:
- Each are written in Rust.
- Each Use the ChaCha20 algorithm for encryption.
- Each make use of equivalent VM shutdown and snapshot-wiping instructions.
- Each use the identical person interface command parameters, the identical file naming conference, and the identical ransom be aware decryption methodology.
- Each use intermittent encryption on bigger information.
For context, ALPHV carried out an exit rip-off in early March 2024 involving faux claims about an FBI takedown operation after they stole a large $22 million fee from Change Healthcare from one among their associates.
Truesec has additionally discovered indications that the Cicada3301 ransomware operation could accomplice with or make the most of the Brutus botnet for preliminary entry to company networks. That botnet was beforehand related to global-scale VPN brute-forcing actions focusing on Cisco, Fortinet, Palo Alto, and SonicWall home equipment.
It is value noting that the Brutus exercise was first noticed two weeks after ALPHV shut down operations, so the hyperlink between the 2 teams nonetheless stands by way of timelines.
One more menace to VMware ESXi
Cicada3301 is a Rust-based ransomware operation with each Home windows and Linux/VMware ESXi encryptors. As a part of Truesec’s report, the researchers analyzed the VMWare ESXi Linux encryptor for the ransomware operation.
Like BlackCat and different ransomware households, comparable to RansomHub, a particular key should be entered as a command line argument to launch the encryptor. This secret’s used to decrypt an encrypted JSON blob that comprises the configuration that the encryptor will use when encrypting a tool.
Truesec says that the encryptor checks for the validity of the important thing by utilizing it to decrypt the ransom be aware and, if profitable, continues with the remainder of the encryption operation.
Its foremost operate (linux_enc) makes use of the ChaCha20 stream cipher for file encryption after which encrypts the symmetric key used within the course of with an RSA key. The encryption keys are generated randomly utilizing the ‘OsRng’ operate.
Cicada3301 targets particular file extensions matching paperwork and media information and checks their measurement to find out the place to use intermittent encryption (>100MB) and the place to encrypt the whole file contents (<100MB).
When encrypting information, the encryptor will append a random seven-character extension to the file title and create ransom notes named ‘RECOVER-[extension]-DATA.txt,’ as proven under. It needs to be famous that BlackCat/ALPHV encryptors additionally used random seven-character extensions and a ransom be aware named ‘RECOVER-[extension]-FILES.txt.’
Supply: BleepingComputer
The ransomware’s operators can set a sleep parameter to delay the encryptor’s execution, doubtlessly to evade instant detection.
A “no_vm_ss” parameter additionally orders the malware to encrypt VMware ESXi digital machines with out making an attempt to close them down first.
Nevertheless, by default, Cicada3301 first makes use of ESXi’s ‘esxcli’ and ‘vim-cmd’ instructions to close down digital machines and delete their snapshots earlier than encrypting knowledge.
esxcli –formatter=csv –format-param=fields==”WorldID,DisplayName” vm course of record | grep -viE ”,(),” | awk -F ””*,”*” '{system(”esxcli vm course of kill –kind=power –world-id=”$1)}’ > /dev/null 2>&1;
for i in `vim-cmd vmsvc/getallvms| awk '{print$1}’`;do vim-cmd vmsvc/snapshot.removeall $i & accomplished > /dev/null 2>&1
Cicada3301’s actions and price of success point out an skilled actor who is aware of what they’re doing, additional supporting the speculation of an ALPHV reboot or no less than using associates with prior ransomware expertise.
The brand new ransomware’s concentrate on ESXi environments highlights its strategic design to maximise harm in enterprise environments that many menace actors now goal for profitable income.
By combining file encryption with the power to disrupt VM operations and take away restoration choices, Cicada3301 ensures a high-impact assault that impacts total networks and infrastructures, maximizing the stress positioned on victims.