Rook’s new ransomware is based on Babuk source code

Sentinel One experts have discovered a new ransomware Rook, which appears to be based on the long-leaked source code of the Babuk ransomware.

The malware payload is usually delivered via Cobalt Strike, using phishing emails and pirated torrents as the initial infection vector. For more stealth, Rook payloads are packaged using UPX or other cryptographic means.

When launched, the ransomware tries to terminate any processes related to security mechanisms or other things that might also interrupt encryption.

Interestingly, in some cases the Process Hacker’s kph.sys driver comes into play when processes are shutting down, but in others it does not. This seems to be due to the need for attackers to use a driver to disable certain local security solutions for certain actions.pravijo strokovnjaki.

The report also notes that Rook uses vssadmin.exe to remove shadow copies.

So far, researchers have not found any pinning mechanisms on the system, so Rook encrypts files by adding the .Rook extension to them, and then deletes itself from the compromised machine.

The researchers write that they noticed numerous code similarities between Rook and Babuk, whose source code was published on a Russian-language forum in the fall of 2021. Na primer, Rook uses the same API calls to get the name and status of each running service, and the same functions to kill them. Poleg tega, the list of eliminated Windows processes and services is the same for both ransomware (including: Steam, Microsoft Office and Outlook email client, as well as Mozilla Firefox and Thunderbird). As a result, Sentinel One experts conclude that Rook is based on the Babuk source code.

The Rooksite of leakshas already posted the data of two victims: a bank and an Indian company working in the aviation and aerospace industry. Information from both victims was added this month, which means it looks like the group is just getting started.

Let me remind you that we wrote that Khonsari ransomware attacks Minecraft servers, as well as that Raziskovalci so odkrili ALPHV izsiljevalska programska oprema, napisana v Rustu.

Helga Smith

Vedno me je zanimalo računalništvo, zlasti varnost podatkov in tema, ki se dandanes imenuje "znanost o podatkih", že od zgodnjih najstniških let. Pred prihodom v ekipo za odstranjevanje virusov kot glavni urednik, Delal sem kot strokovnjak za kibernetsko varnost v več podjetjih, vključno z enim od Amazonovih izvajalcev. Še ena izkušnja: Poučujem na univerzah Arden in Reading.

Pustite odgovor

To spletno mesto uporablja Akismet za zmanjšanje neželene pošte. Preberite, kako se obdelujejo vaši komentarji.

Gumb Nazaj na vrh