BACK
Makop Ransomware
It has been reported that Makop ransomware is actively targeting organisations including critical sectors. Makop ransomware encrypts the files on the victim's systems and asks for ransom payment in bitcoin.
Makop is an offshoot of the PHOBOS ransomware variant and operates under an affiliate structure.
Infection Mechanism
Makop Ransomware leverages different techniques to enter organizations' networks and inject the payload. The most common attack vectors include the exploitation of internet-exposed systems having exposed unsecured RDP services, phishing emails carrying malicious attachments (often using unusual file extensions to bypass email scans), torrent websites, malicious advertisements etc.
- PowerShell: Downloads and executes a batch script on the impacted systems
- NS.exe: Scan the network and search for shared folders
- Everything.exe: Search filenames or create file listing
- Mouselock.exe: Block mouse inputs
- NLBrute.exe: Brute-force RDP credentials
- Batch scripts: To disable and delete Volume Shadow Copies
- RDP: Move laterally through the environment
- mc_hand.exe : Ransomware executable
The threat group is also known to leverage PuTTY, Mimikatz, YDArk, Advanced Port Scanner and PsExec to perform the attacks.
Makop Ransomware uses AES-256 algorithm for encrypting files and typically adds the “.makop” or “.mkp” extension to the encrypted files.
Fig.1 Screenshot of Makop Ransomware GUI (Source: Aon)
Fig.2 Makop encrypted file samples (Source: Cyfirma)
Indicator of Compromise:
Hashes:
- 2881a2a79b9dde2a036648df3f04996cac0401505af3d67156ceb1a4d9011b7c
- f43b86ff363f19f26cc7d80aa64fa0894a264a736ae0abd013d98e344637e4d8
- 08c9f2ba64a192c0c75fcac51019ee996bf1a617eb66cf04acaa9b8e4a3ea36e
- d66bfeb539f4b6f81d0610a128d8a7ebbf559b37df226c5c8b3e04d64c37be0d
- 4aace7fd7ba4c0eb24454f9bbf161499363ff34fc5c2eb81b982a25cfc0fdd27
- c5c28f06fc605a7b68c52713f035f7546a15f0ca19761f96903a55021d62c733
- dee9199b48489b9077ea11a57303eda7bd33f5d7bca45415a979bca027e246fd
- aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da
- 3664ff8050ccf9e6d73e197f43e23422dcc5bd738c4c5d90808370bc6dba7868
- 5566123b7485a9e1e25f06bc695d07ba485866d9cbb9a13460676e980d2dd72a
- 585829269d87b4b63c3cc4c6d855c0077190c2ae888e1e52aad013e2f1eb652a
- 50901c4dce9b5674b68da3503240b62561af7d99d21ff30c8ec2f4977feb4485
- d453c980cc00eab746f80c8bae57728c1d5bab12970605a7644674ca63f26e0f
- e48904c3a631f353f6bf1cd3c2509464c86454db1d29bff26b489ffa563788d9
- 62f796350dae2c66d9505c47f29569410d520d1cf17e33ef2be5d0a2358fb094
- 72bbcfca7e495c8a32ee6a88234e55378a535761fd4eb97b50c69bc1dbb3478b
- 7d4b154e90a8472545d84d7d1ec49888269872c9a8adf3a0411317c8f926f1f5
- bff786ac2f9f89305650d5776dbf1ada6ab229ab87be2c335aedaaf7c438185e
- e245f8d129e8eadb00e165c569a14b71
- 6A58B52B184715583CDA792B56A0A1ED
- b69d036d1dcfc5c0657f3a1748608148
Email IDs:
- datastore@cyberfear[.]com
- back2up@swismail[.]com
File Names:
- mc_hand.exe : Ransomware executable
- Everything.exe : Search filenames or create file listing
- Mouselock.exe : Block mouse inputs
- NLBrute.exe: Brute-force RDP credentials
Best Practices and Recommendations:
- Maintain offline backups of data, and regularly maintain backup and restoration. This practice will ensure the organization will not be severely interrupted, and have irretrievable data.
- Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted) and covers the entire organization’s data infrastructure.
- Implement all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts) to have strong, unique passwords.
- Implement multi-factor authentication for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.
- Consider restricting/disabling command-line and scripting activities and permissions.
- Disable unused ports & services. Priortize hardening of internet-facing systems.
- Remove unnecessary access to administrative shares.
- Use a host-based firewall to only allow connections to administrative shares via server message block (SMB) from a limited set of administrator machines.
- Enable protected files in the Windows Operating System to prevent unauthorized changes to critical files.
- Disable Remote Desktop Connections, employ least-privileged accounts. Limit users who can log in using Remote Desktop, set an account lockout policy. Ensure proper RDP logging and configuration.
- Check regularly for the integrity of the information stored in the databases.
- Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems.
- Establish Domain-based Message Authentication, Reporting, and Conformance (DMARC), DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF) for your domain.
- Keep the operating system, software and firmware up-to-date with the latest patches.
- Application white listing/Strict implementation of Software Restriction Policies (SRP).
- Maintain updated Antivirus software on all systems.
- Don't open attachments in unsolicited emails.
- Follow safe practices when browsing the web.
- Network segmentation and segregation into security zones.
- Disable ActiveX content in Microsoft Office applications.
- Restrict access using firewalls.
- Use strong authentication protocols.
- Additional Security measures that may be considered are:
- Use RDP Gateways for better management.
- Change the listening port for Remote Desktop.
- Tunnel Remote Desktop connections through IPSec or SSH.
- Two-factor authentication may also be considered for highly critical systems.
- If not required consider disabling PowerShell / windows script hosting.
- Restrict users' abilities (permissions) to install and run unwanted software applications.
- Enable personal firewalls on workstations.
- Implement strict External Device (USB drive) usage policy.
- Employ data-at-rest and data-in-transit encryption.
- Consider installing Enhanced Mitigation Experience Toolkit.
- Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
- Carry out vulnerability Assessment and Penetration Testing (VAPT).
- Individuals or organizations are not encouraged to pay the ransom.
References
- https://www.aon.com/cyber-solutions/aon_cyber_labs/dissection-of-makop-ransomware-group/
- https://securityaffairs.com/143452/malware/dissecting-makop-ransomware.html
- https://www.cyfirma.com/research/technical-analysis-makop-ransomware/
- https://www.cert-in.org.in/PDF/RANSOMWARE_Report_2022.pdf
- https://www.csk.gov.in/alerts/ransomware.html