www.bleepingcomputer.com
Open in
urlscan Pro
104.20.59.209
Public Scan
URL:
https://www.bleepingcomputer.com/news/security/oldgremlin-ransomware-gang-targets-russia-with-new-malware/
Submission: On April 18 via api from US — Scanned from DE
Submission: On April 18 via api from US — Scanned from DE
Form analysis 6 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/oldgremlin-ransomware-gang-targets-russia-with-new-malware/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/oldgremlin-ransomware-gang-targets-russia-with-new-malware/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/oldgremlin-ransomware-gang-targets-russia-with-new-malware/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
* News
* Featured
* Latest
* GitHub: Attacker breached dozens of orgs using stolen OAuth tokens
* Cisco vulnerability lets hackers craft their own login credentials
* T-Mobile customers warned of unblockable SMS phishing attacks
* Karakurt revealed as data extortion arm of Conti cybercrime syndicate
* Unofficial Windows 11 upgrade installs info-stealing malware
* Windows 10 21H2 now in broad deployment, available to everyone
* Beanstalk DeFi platform loses $182 million in flash-load attack
* Manage your passwords with an Enpass lifetime subscription deal
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to Translate a Web Page in Google Chrome
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* OldGremlin ransomware gang targets Russia with new malware
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditRedditShare to Hacker NewsHacker NewsShare to
EmailEmail
*
OLDGREMLIN RANSOMWARE GANG TARGETS RUSSIA WITH NEW MALWARE
By
IONUT ILASCU
* April 14, 2022
* 04:55 AM
* 0
OldGremlin, a little-known threat actor that uses its particularly advanced
skills to run carefully prepared, sporadic campaigns, has made a comeback last
month after a gap of more than one year.
The group distinguishes itself from other ransomware operations through the
small number of campaigns - less than five since early 2021 - that target only
businesses in Russia and the use of custom backdoors built in-house.
Despite being less active, which may suggest that the ransomware business is
closer to moonlighting, OldGremlin has demanded ransoms as high as $3 million
from one of its victims.
PLAY Top Articles Video Settings Full Screen About Connatix V159212 Read More
Read More Read More Read More Read More Read More Windows 10 21H2 now in broad
deployment,available to everyone 1/1 Skip Ad Continue watching after the ad
Visit Advertiser websiteGO TO PAGE
CAREFULLY PREPARED PHISHING
The most recent OldGremlin activity consists of two phishing campaigns launched
towards the end of March 2022. It is too early to assess how many companies were
targeted but security researchers say that at least one Russian company in the
mining sector is on the victim list.
The adversary did not steer away from its previously observed tactic to obtain
initial access and took advantage of trending news topics.
Security researchers at Singapore-based cybersecurity company Group-IB say that
this time OldGremlin impersonated a senior accountant at a Russian financial
organization warning that the recent sanctions imposed on Russia would suspend
the operations of the Visa and Mastercard payment processing systems.
Hello,
We, at [masked], have received reliable information about new sanctions in the next couple of days. The Visa/Mastercard payment system will be shut down completely. All cards issued in our country will no longer work.
Everyone must therefore urgently issue [masked] cards and link them to their bank payroll.
Use the following instructions [hyperlink] for the following banks: [masked]
Fill out the form (see attachment) and send it back, making sure to specify the bank branch at which it is convenient for you to pick up the bank card.
Remember that if you want to link a card to a payroll, you must inform the accounting department of the account details after receiving the card.
Please sign and send the form to our email address within 5 (five) hours from the moment you receive this email. For the purposes of efficiency, please send it in this email thread chain.
[masked],
Senior Accountant at [masked]
NEW CUSTOM BACKDOOR
The email pointed the recipient to a malicious document stored in a Dropbox
storage that downloads a backdoor called TinyFluff, which launches the Node.js
interpreter and gives the attacker remote access to the target system.
TinyFluff is a new variant of an older backdoor, TinyNode, the gang used in past
attacks. The image below shows the infection chains from the two OldGremlin
campaigns this year on March 22 and March 25:
OldGremlin infection chain March 2022 (surce: Group-IB)
Group-IB researchers discovered two variants of TinyFluff, an earlier one that
is more complex and a newer, simplified version that copies the script and the
Node.js interpreter from its storage location at 192.248.176[.]138.
“We believe that the first, more complex, version of TinyFluff was raw. That’s
why the gang simplified the tool so they could use it on the fly. However, they
will most likely improve it for further attacks” - Group-IB Threat Intelligence
team
Both variants of the backdoor are currently detected by more than 20 antivirus
engines on the Virus Total scanning platform.
In a report shared with BleepingComputer, Group-IB provides indicators of
compromise and a detailed technical analysis of the tools OldGremlin used in the
two phishing campaigns deployed last month.
After planting the backdoor, OldGremlin proceeds to the reconnaissance stage,
checking if the application is running in a test environment.
The commands for this stage of the attack are delivered in clear text, allowing
the researchers to examine them using a traffic sniffer
* collecting information about the infected system/device
* obtaining information about connected drives
* launching the cmd.exe shell, executing a command, and sending the output to
the command and control server (C2)
* obtaining information about the plugins installed in the system
* getting information about files in the specific directories on the system
drive
* terminating the Node.js interpreter
OldGremlin can spend months inside the compromised network before deploying the
final stage of the attack: delivering TinyCrypt/TinyCryptor, the group’s custom
ransomware payload.
Just like with ransomware attacks from other gangs, the victim gets a ransom
note that provides a contact to reach the threat actor for payment negotiations.
OldGremlin ransom note from 2020 (source: Group-IB)
Group-IB told BleepingComputer that OldGremlin encrypted at least three
companies since the researchers started tracking the gang in 2020.
Although this number is insignificant in comparison with attacks from other
ransomware gangs, the researchers note that OldGremlin spends all year reaping
the benefits of the few campaigns they launch.
In 2021, the gang deployed only one phishing campaign but it was enough to keep
them busy the entire year as it provided initial access to the network of
multiple businesses.
Group-IB says that it’s just a matter of time for a larger number of
OldGremlin’s victims, apart from the targeted Russian mining company, to be
uncovered this year as a result of the group’s March phishing activity.
Based on the evidence they found and after analyzing the quality of the phishing
emails and the decoy documents, the researchers assess that OldGremlin has
Russian-speaking members.
They described the knowledge the group has of the Russian landscape as
“astonishing.”
By focusing only on Russian companies (banks, industrial enterprises, medical
organizations, and software developers), OldGremlin breaks the unspoken rule of
not attacking entities in the Russian territories.
Group-IB's report on the recent OldGremlin campaigns, including technical
analysis of the attacks and indicators of compromised is available on the
company's website.
RELATED ARTICLES:
The Week in Ransomware - April 15th 2022 - Encrypting Russia
Hackers use Conti's leaked ransomware to attack Russian companies
Top Russian meat producer hit with Windows BitLocker encryption attack
More Conti ransomware source code leaked on Twitter out of revenge
REvil ransomware member extradited to U.S. to stand trial for Kaseya attack
* Backdoor
* OldGremlin
* Ransomware
* Russia
* Facebook
* Twitter
* LinkedIn
* Email
*
IONUT ILASCU
Ionut Ilascu is a technology writer with a focus on all things cybersecurity.
The topics he writes about include malware, vulnerabilities, exploits and
security defenses, as well as research and innovation in information security.
His work has been published by Bitdefender, Netgear, The Security Ledger and
Softpedia.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* GitHub suspends accounts of Russian devs at sanctioned companies
* Customize your Windows 11 experience with these apps
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2022 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT