Makop

attackers used to send more than a million emails per month, distributing at least seven distinct malware families in dozens of campaigns using a variety of phishing lures and tactics

The emails had .zip attachments containing executables with file names that resembled resumes from job seekers. Once a user opened the attachments, the executables delivered Makop

Upon infection, the malware quickly used the WMI command-line (WMIC) utility and deleted shadow copies.

the core tactics and tools that they use are still limited in scope, relying repeatedly on familiar malicious macros, lures, and sending tactics

“Execution T1059.003 Command and Scripting Interpreter: Windows Command Shell” and “The ransomware terminates processes such as vssadmin.exe Delete Shadows /all /quiet and wmic shadowcopy delete /nointeractive…”

the attackers used a Makop ransomware variant with many modified elements, including added persistence via scripts in the Startup folder before triggering a reboot... Dridex then modified RUN keys to automatically start the Dridex executable

the attackers used a Makop ransomware variant with many modified elements, including added persistence via scripts in the Startup folder before triggering a reboot... Dridex then modified RUN keys to automatically start the Dridex executable

“Defense Evasion T1027.005 Obfuscated Files or Information: Indicator Removal from Tools” (Ndm448 list).

Upon infection, the malware quickly used the WMI command-line (WMIC) utility and deleted shadow copies.

“Defense Evasion T1564.003 Hide Artifacts: Hidden Window” (Ndm448 list).

“Discovery T1057 Process Discovery” (Ndm448 list) and also present in UNC3886 list.

“Discovery T1083 File and Directory Discovery” (Ndm448 list) and narrative describing rapid traversal of user/system directories prior to encryption.

“Discovery T1135 Network Share Discovery” (Ndm448 list) and description: “full file encryption across local and accessible network drives”.

“Discovery T1518 Software Discovery” (Ndm448 list) and also in UNC3886 list (including security software discovery variant).

“Discovery T1614 System Location Discovery” (Ndm448 list) and also in UNC3886 list.

additional encoded PowerShell commands were used in a similar fashion to download a .zip file that contained a Dridex DLL

COLCERT AL-2810-054 Campaña de ransomware - Makop y Crysis en Colombia

It then used the BCEdit tool and altered the boot configuration to ignore future failures and prevent restoration before encrypting all files