What We Do
How we do it
Resources
TRU INTELLIGENCE CENTER
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
SECURITY ADVISORIES
Nov 21, 2022
ProxyNotShell Exploit Released
THE THREAT eSentire is aware of public Proof-of-Concept (PoC) exploit code for the ProxyNotShell Exchange vulnerabilities (CVE-2022-41040 [CVSS:8.8], CVE-2022-41082 [CVSS:8.0]). The publication of…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Nov 07, 2022
Global Cybersecurity Leader eSentire Partners with InfoTrust to Deliver 24/7 Multi-Signal MDR and IR Services Across Australia
Waterloo, ON and Sydney, Australia – November 9, 2022 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced it has expanded its presence in Australia via a strategic partnership with InfoTrust. InfoTrust is a leading specialized cybersecurity provider that combines next-generation security controls, with the InfoTrust “Connective Tissue” of customer success,…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Nov 09, 2022

Intruder Deploys Medusa Unlocker instead of Medusa Locker in Attempted Medusa Ransomware Operation Targeting eSentire Legal Customer

5 minutes read
Speak With A Security Expert Now

Recently, a hands-on intruder immediately began to attempt lateral movement and gain credential access upon successful abuse of compromised RDP credentials at a legal firm that is an eSentire MDR customer.

After performing initial network discovery with Advanced IP Scanner and PC Hunter (tool that allows kernel manipulations and terminate processes), the intruder deployed mimikatz and attempted to move laterally to five hosts within the network.

Of the five hosts, four were adequately protected and sent security alerts to eSentire‘s 24/7 Security Operations Center (SOC). However, the fifth host was outside of endpoint monitoring scope and the threat actor was able to successfully compromise it.

The threat actor‘s ability to move laterally resulted in them accessing an endpoint-protected host, which resulted in the escalation of the incident to Incident Handlers and eSentire’s Threat Response Unit (TRU). Without endpoint telemetry for the compromised hosts, investigators pivoted to network and log data to pinpoint the cyberattack.

By the time the hands-on attacker was engaged and ejected from the legal firm‘s internal environment, they had attempted to deploy MedusaLocker, but ultimately failed in the deployment.

Analysis of the deployed payload showed that the actor had accidentally deployed the Medusa Unlocker – the decrypter (Figure 1) – instead of the actual ransomware, MedusaLocker (MD5: 908e3b6aab0126ef4efcdc8c4805abd7) (Figure 2). It‘s likely this occurred due to the similarity in names.

Figure 1: Analysis of the deployed binary concluded to be a decrypter


Figure 2: MedusaLocker expected crypter task flow

Toolset and Tactics

As is typical of ransomware intrusion today, the intruder leveraged Cobalt Strike to deploy and manage tools and C2, including mimikatz, to gain credential access for network discovery and lateral movement (Figure 3). The toolset has some overlap with intruders observed deploying ALPHV or BlackCat ransomware.

060c523563e6d33bc8d0576aa18cf835ecac460c9980246e055508f980e14f9b - Medusa Unlocker - c:\users\prolaw\pictures\64\56771.exe
ca5952b6e5d4aeb9263afe91b3524ac9cc654b88a7c90b41ec75e3506c6aa570 - webbrowserpassview.exe
ad6b98c01ee849874e4b4502c3d7853196f6044240d3271e4ab3fc6e3c08e9a4 - psexec64.exe 
3337e3875b05e0bfba69ab926532e3f179e8cfbf162ebb60ce58a0281437a7ef - psexec.exe
6a87226ed5cca8e072507d6c24289c57757dd96177f329a00b00e40427a1d473 - netpass (1).exe
6d924d92e3084190ed4bb9fed5435f5280f738e5842b8bb3fa6df5f408d2009d - pchunter64_s.exe
0ad926fa666acba562446f68c77199b5b2dc79b68245a04e3b6efd2a88ceae9a - pchunter64_у1.exe
8846c8be509a4b274d6d1465e9cc14d44cfb0a51f917d3a00ce00fa0b35a4284 - mimikatz.dll
bee3d0ac0967389571ea8e3a8c0502306b3dbf009e8155f00a2829417ac079fc - mimidrv.sys
d9770865ea739a8f1702a2651538f4f4de2d92888d188d8ace2c79936f9c2688 - mimilib.dll
96632f716df30af567da00d3624e245d162d0a05ac4b4e7cbadf63f04ca8d3da - mimispool.dll

Figure 3: Tools deployed to compromised endpoints

Infrastructure Analysis

The C2 infrastructure leveraged by the threat actor was a Windows Virtual Private Service (VPS) with RDP and WinRM open (Figure 4) bearing self-signed certs with the hostname: RUTHERFORD. Windows RDP configurations for C2 have been observed before, leveraged by various affiliates deploying ransomware – notably Diavol, Conti, and Lockbit.

In some cases, threat actors are able to register these machines with the victim organization‘s network, leveraging Cobalt Strike as a reverse proxy since the machine names can sometimes be tracked. For example, the system name WIN-LIVFRVQFMKO appeared in a similar incident intercepted by TRU in Summer 2022. The system name also appeared in Conti leaks chat and a LockBit ransomware incident. These re-used hostnames could be the result of malicious infrastructure providers, such as Deep Cack and vps_crack_team, helping their customers by avoiding individual identifiers.

Figure 4: Machine Info of attacking computer taken from open-source scanners.


In the case of MedusaLocker, the machine name choice, RUTHERFORD, was likely an artifact of the Virtual Private Service (VPS) provider the hackers used. Selectel, a Russian based IT infrastructure provider supports RDP Windows machines and uses naming conventions of historical physicists and mathematicians for their hostnames, such as RUTHERFORD , NEWTON, HILBERT, and LOBACHEVSKY.

Although it's not yet known why Selectel does not use an individual naming scheme for leased RDP infrastructure, the end result is the same as malicious infrastructure providers – uniquely identifying infrastructure use becomes more complex.

Recommendations from TRU to Protect Your Organization from This Cyber Threat

As the adversarial TTPs grow in sophistication, they lead to a certain level of difficulty at which critical business decisions must be made. Preventing the various attack paths utilized by modern threat actors requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions. To increase your resilience against cyber threats like this, we recommend:

  1. Endpoint monitoring: Deploy an Endpoint Detection and Response solution for 24/7 endpoint monitoring to workstations, ensure the endpoints leverage rules around User Execution and Windows Proxy Execution. When managed properly, endpoint monitoring can detect many initial access attacks and most post-compromise actions such as network discovery, credential access, and lateral movement.
    • In this specific case, if the endpoint where the initial access occured had endpoint detection implemented, this incident would have very likely not happened.
  2. Leveraging solutions like VPNs, MFA, and firewalls: Machines with RDP open (3389) to the internet are a risk and should be adequately covered with additional protections:
    • VPN: Ensure internet-facing machines are behind a Virtual Private Network.
    • MFA: Ensure all your systems are up-to-date with Multi-Factor Authentication (MFA) in place.
    • Firewall: Consider firewall rules that only allow particular ranges for RDP traffic.
  3. Managing your inventory effectively: Ensure you‘re keeping track of your inventory and your cybersecurity posture with respect to the current threat landscape.
  4. Leveraging threat intelligence capabilities: To keep track of what cybercriminals are doing, the TTPs used, and emerging cyber threats, you‘ll need highly-skilled staff that can correlate and enrich intelligence extracted from daily threat investigations and multiple third-party sources.

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire cybersecurity specialist.

View Most Recent Blogs
eSentire Threat Response Unit (TRU)
eSentire Threat Response Unit (TRU)

Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our Atlas XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen.