New ransomware group uses SonicWall zero-day to breach networks

A financially motivated threat actor exploited a zero-day bug in SonicWall SMA 100 Series VPN appliances to deploy new ransomware known as FiveHands on the networks of North American and European targets.

The group, tracked by Mandiant threat analysts as UNC2447, exploited the CVE-2021-20016 SonicWall vulnerability to breach networks and deploy FiveHands ransomware payloads before patches were released in late February 2021.

Prior to deploying the ransomware payloads, UNC2447 was also observed using Cobalt Strike implants for gaining persistence and installing a SombRAT backdoor variant, a malware first spotted in the CostaRicto campaign coordinated by a group of mercenary hackers.

The zero-day was also exploited in attacks targeting SonicWall’s internal systems in January and later abused indiscriminately in the wild.

Undercover HelloKitty

The FiveHands ransomware deployed in UNC2447 attacks was first observed in the wild during October 2020.

It is also very similar to HelloKitty ransomware, both of them rewrites of DeathRansom ransomware.

The former was used to encrypt the systems of video game development studio CD Projekt Red [1, 2], with the attackers later claiming to have stolen the source code for Cyberpunk 2077, Witcher 3, Gwent, and an unreleased version of Witcher 3.

This ransomware operation has also targeted other large companies worldwide, including Brazilian power company CEMIG (Companhia Energética de Minas Gerais).

As discovered by Mandiant, HelloKitty activity had slowly dwindled starting with January 2021 when FiveHands usage in attacks began to pick up.

“Based on technical and temporal observations of HELLOKITTY and FIVEHANDS deployments, Mandiant suspects that HELLOKITTY may have been used by an overall affiliate program from May 2020 through December 2020, and FIVEHANDS since approximately January 2021,” the researchers said.

Besides their sharing feature, functionality, and coding similarities, the two malware strains were also linked by Mandiant earlier this month after observing a FiveHands ransomware Tor chat using a HelloKitty favicon.

BleepingComputer reported earlier today on Whistler resort municipality being hit by a new ransomware operation using a very similar Tor site, but it’s not clear if there are any links to the FiveHands ransomware operation.

FiveHands also has extra functionality since, unlike HelloKitty and DeathRansom, it can also “use the Windows Restart Manager to close a file currently in use so that it can be unlocked and successfully encrypted.”

It further differs by using different embedded encryption libraries, a memory-only dropper, and asynchronous I/O requests, not present in the two other ransomware strains in its family.

Ragnar Locker ransomware also deployed by UNC2447 affiliates

“UNC2447 monetizes intrusions by extorting their victims first with FIVEHANDS ransomware followed by aggressively applying pressure through threats of media attention and offering victim data for sale on hacker forums,” Mandiant added in a report published today.

“UNC2447 has been observed targeting organizations in Europe and North America and has consistently displayed advanced capabilities to evade detection and minimize post-intrusion forensics.”

Mandiant says that UNC2447 affiliates have also been observed deploying Ragnar Locker ransomware activity in previous attacks.

In March, Mandiant analysts discovered three more zero-day vulnerabilities in SonicWall’s on-premises and hosted Email Security (ES) products.

These zero-days were also actively exploited by another group tracked as UNC2682 to backdoor systems using BEHINDER web shells to move laterally through the victims’ networks and gain access to emails and files.