Cybercrime Group Asking Insiders for Help in Planting Ransomware

A Nigerian threat actor has been observed attempting to recruit
employees by offering them to pay $1 million in bitcoins to deploy
Black Kingdom ransomware on companies’ networks as part of an
insider threat scheme.

“The sender tells the employee that if they’re able to deploy
ransomware on a company computer or Windows server, then they would
be paid $1 million in bitcoin, or 40% of the presumed $2.5 million
ransom,” Abnormal Security said^[1]
in a report published Thursday. “The employee is told they can
launch the ransomware physically or remotely. The sender provided
two methods to contact them if the employee is interested—an
Outlook email account and a Telegram username.”

Black Kingdom, also known as DemonWare and DEMON, attracted
attention earlier this March when threat actors were found exploiting ProxyLogon flaws^[2] impacting Microsoft
Exchange Servers to infect unpatched systems with the ransomware
strain.

Abnormal Security, which detected and blocked the phishing
emails on August 12, responded to the solicitation attempt by
creating a fictitious persona and reached out to the actor on
Telegram messenger, only to have the individual inadvertently spill
the attack’s modus operandi, which included two links for an
executable ransomware payload that the “employee” could download
from WeTransfer or Mega.nz.

“The actor also instructed us to dispose of the .EXE file and
delete it from the recycle bin. Based on the actor’s responses, it
seems clear that he 1) expects an employee to have physical access
to a server, and 2) he’s not very familiar with digital forensics
or incident response investigations,” said Crane Hassold, director
of threat intelligence at Abnormal Security.

Besides taking a flexible approach to their ransom demands, the
plan is believed to have been concocted by the chief executive of a
Lagos-based social networking startup called Sociogram, with the
goal of using the siphoned funds to “build my own company.” In one
of the conversations that took place over the course of five days,
the individual even took to calling himself “the next Mark
Zuckerberg.”

Also of particular note is the method of using LinkedIn to
collect corporate email addresses of senior-level executives, once
again highlighting how business email compromise (BEC) attacks
originating from Nigeria continue to evolve and expose businesses
to sophisticated attacks like ransomware.

“There’s always been a blurry line between cyberattacks and
social engineering, and this is an example of how the two are
intertwined. As people become better at recognizing and avoiding
phishing, it should be no surprise to see attackers adopt new
tactics to accomplish their goals,” Tim Erlin, vice president of
product management and strategy at Tripwire, said.

“The idea of a disgruntled insider as a cybersecurity threat
isn’t new. As long as organizations require employees, there will
always be some insider risk. The promise of getting a share of the
ransom might seem attractive, but there’s almost zero guarantee
that this kind of complicity will actually be rewarded, and it’s
highly likely that someone taking this attacker up on their offer
would get caught,” Erlin added.