RomCom Hackers Exploit Microsoft Office Zero-Day to Spread Ransomware

Underground ransomware, a threat primarily targeting Microsoft Windows systems, has been gaining momentum, which encrypts victims’ files, rendering them inaccessible, and demands a ransom payment for decryption. 

An impact of this attack is severe, as it can disrupt operations and lead to significant data loss. Organizations using Microsoft Windows should be vigilant and implement robust security measures to mitigate the risks associated with underground ransomware.

The first instance of ransomware, which targets Windows systems and encrypts files and leaves ransom notes demanding payment for decryption, was discovered in the early part of July 2023. 

The ransomware’s initial detection coincided with the posting of its first victim on its data leak site, which aligns with the typical behavior of ransomware, which often involves file encryption and ransom demands.

The Russia-based RomCom group, also known as Storm-0978, is deploying the Underground ransomware, likely exploiting the CVE-2023-36884 vulnerability in Microsoft Office and Windows HTML RCE, which could be the primary infection vector for the ransomware. 

However, the group may also utilize other common tactics, such as phishing emails or purchasing access from an Initial Access Broker, to gain entry into target systems.

The Underground ransomware first deletes shadow copies to prevent data recovery. Then, it limits the maximum duration of Remote Desktop sessions to 14 days after user disconnection, potentially hindering data recovery efforts. 

Next, it stops the MS SQL Server service, likely to disrupt database operations and data access. Finally, it creates a ransom note, informing victims of the attack and demanding a ransom payment.

Upon execution, it refrains from modifying file extensions but proceeds to encrypt files by strategically avoiding encrypting essential system files with specific extensions to maintain system functionality. 

After encrypting files, the ransomware generates and executes a temporary command script, temp.cmd, which performs crucial tasks, including the removal of the original ransomware file to prevent its detection and eradication. 

According to Fortinet, the script also targets Windows Event logs, systematically deleting them to hinder any forensic investigation into the ransomware attack.

The Underground ransomware group, active since at least March 2024, has a data leak site where they publish stolen information from their victims, spanning across various industries including construction, pharmaceuticals, banking, and manufacturing, and are primarily located in the United States and Europe. 

The group targets specific industries, as indicated by a dropdown list on their data leak site, and they also utilize Telegram and Mega to distribute stolen data, showcasing their digital footprint and tactics for disseminating compromised information.

Also Read:

Bonjour Service on macOS & Windows Exposes Users to Privilege Escalation Attacks

See more