New ransomware Epsilon Red discovered – how it works – SecurityBrief New Zealand

New ransomware Epsilon Red has been found by Sophos researchers who detail the tools, techniques, procedures, and behaviour of the attackers behind it.

Sophos' researchers have discovered the Epsilon Red ransomware is delivered as the final executable payload in a manually orchestrated attack. And according to their analysis, every other component of the attack relies on PowerShell scripts.

The PowerShell scripts include:

Sophos says the ransom note left behind on the infected computers resembles that left by REvil ransomware, although the Epsilon Red operators appear to have made a few grammatical language corrections.

The attackers encourage victims to engage with them via a website. Based on the cryptocurrency address provided by the attackers, it would seem at least one of Epsilon Reds victims paid a ransom of 4.29BTC (around US$210,000).

Epsilon Red is an intriguing new ransomware, says Sophos Rapid Response manager, Peter Mackenzie.

The actual ransomware file itself is very pared down, probably because it has offloaded other tasks, such as deleting backs ups, to the PowerShell scripts. It is really only used for file encryption, and it doesnt precision-target assets. If it decides to encrypt a folder, it will encrypt everything inside that folder.

Unfortunately, this can mean other executables and dynamic link libraries (DLLs) are also encrypted, which can disable key running programs or the entire system. As a result, the attacked machine will need to be completely rebuilt, he says.

The Sophos analysis of the attackers behaviour could suggest they lack confidence in the reliability of their tools or the potential success of their attack, so they include alternative options and backup plans in case things fail.

Early on in the attack sequence the operators download and install a copy of Remote Utilities and the Tor Browser, possibly to ensure an alternate foothold if the initial access point gets locked down, says Sophos.

In other cases we see the operators issue redundant commands that use a slightly different method to accomplish the same goal, such as deleting processes and backups. The best way to prevent ransomware such as Epsilon Red is to ensure servers are fully patched and that security solutions can detect and block any suspicious behaviour and attempted file encryption.

The rest is here:
New ransomware Epsilon Red discovered - how it works - SecurityBrief New Zealand