Dridex Malware Deploying Entropy Ransomware on Hacked Computers

Similarities have been unearthed between the Dridex
general-purpose malware and a little-known ransomware strain called
Entropy, suggesting that the operators are continuing to
rebrand their extortion operations under a different name.

“The similarities are in the software packer used to conceal the
ransomware code, in the malware subroutines designed to find and
obfuscate commands (API calls), and in the subroutines used to
decrypt encrypted text,” cybersecurity firm Sophos said^[1]
in a report shared with The Hacker News.

The commonalities were uncovered following two unrelated
incidents targeting an unnamed media company and a regional
government agency. In both cases, the deployment of Entropy was
preceded by infecting the target networks with Cobalt Strike
Beacons and Dridex, granting the attackers remote access.

Despite consistency in some aspects of the twin attacks, they
also varied significantly with regards to the initial access vector
used to worm their way inside the networks, the length of time
spent in each of the environments, and the malware employed to
launch the final phase of the invasion.

The attack on the media organization used the ProxyShell exploit^[2]
to strike a vulnerable Exchange Server with the goal of installing
a web shell that, in turn, was utilized to spread Cobalt Strike
Beacons on the network. The adversary is said to have spent four
months carrying out reconnaissance and data theft, ultimately
paving the way for the ransomware attack in early December
2021.

The second attack on the regional government organization, on
the other hand, was facilitated through a malicious email
attachment containing the Dridex malware, using it to deploy
additional payloads for lateral movement.

Notably, redundant exfiltration of sensitive data to more than
one cloud storage provider – in the form of compressed RAR archives
– transpired within 75 hours after the initial detection of a
suspicious login attempt on a single machine, prior to encrypting
the files on the compromised computers.

Besides using legitimate tools such as AdFind^[3], PsExec^[4], and PsKill^[5]
to carry out the attacks, the correlation between Dridex and
Entropy samples with that of previous DoppelPaymer ransomware
infections has raised the possibility of a “common origin.”

Entropy Ransomware Note

It’s worth pointing out the web of connections between the
different pieces of malware. The Dridex^[6]
trojan, an information-stealing botnet, is known to be the
handiwork of a prolific Russia-based cybercrime group called Indrik
Spider (aka Evil Corp).

DoppelPaymer is attributed to a splinter group^[7]
tracked under the moniker Doppel Spider, which leverages^[8]
forked malware code^[9]
developed by Indrik Spider, including the BitPaymer ransomware, as
the foundation for its big game hunting operations.

In December 2019, the U.S. Treasury Department sanctioned Evil
Corp and filed criminal charges against two key members Maksim
Yakubets and Igor Turashev, in addition to announcing a $5 million
reward for any information leading to their arrests. A subsequent investigation^[10] by BBC in November 2021
tracked down the “alleged hackers living millionaire lifestyles,
with little chance of ever being arrested.”

The e-crime gang has since cycled through numerous branding
changes to their ransomware infrastructure in the intervening years
to get around the sanctions, chief among them being WastedLocker^[11], Hades^[12], Phoenix^[13], PayloadBIN^[14], Grief^[15], and Macaw^[16]. Entropy is likely the
latest addition to this list.

That said, it’s also possible that the malware operators have
borrowed the code, either to save development efforts or
deliberately mislead attribution in what’s a false flag
operation.

“In both cases, the attackers relied upon a lack of diligence –
both targets had vulnerable Windows systems that lacked current
patches and updates,” said Andrew Brandt, principal researcher at
Sophos. “Properly patched machines, like the Exchange Server, would
have forced the attackers to work harder to make their initial
access into the organizations they penetrated.”

“A requirement to use multi-factor authentication, had it been
in place, would have created further challenges for unauthorized
users to log in to those or other machines,” Brandt added.