New EX-22 Tool Empowers Hackers with Stealthy Ransomware Attacks on Enterprises

Feb 28, 2023Ravie LakshmananRansomware / Malware

A new post-exploitation framework called EXFILTRATOR-22 (aka
EX-22) has emerged in the wild with the goal of deploying
ransomware within enterprise networks while flying under the
radar.

“It comes with a wide range of capabilities, making
post-exploitation a cakewalk for anyone purchasing the tool,”
CYFIRMA said^[1]
in a new report.

Some of the notable features include establishing a reverse
shell with elevated privileges, uploading and downloading files,
logging keystrokes, launching ransomware to encrypt files, and
starting a live VNC (Virtual Network Computing) session for
real-time access.

It’s also equipped to persist after system reboots, perform
lateral movement via a worm, view running processes, generate
cryptographic hashes of files, and extract authentication
tokens.

The cybersecurity firm assessed with moderate confidence that
threat actors responsible for creating the malware are operating
from North, East, or Southeast Asia and are likely former
affiliates of the LockBit ransomware^[2].

Advertised as a fully undetectable malware on Telegram and
YouTube, EX-22 is offered for $1,000 a month or $5,000 for lifetime
access. Criminal actors purchasing the toolkit are provided a login
panel to access the EX-22 server and remotely control the
malware.

Since its first appearance on November 27, 2022, the malware
authors have continuously iterated the toolkit with new features,
indicating active development work.

The connections to LockBit 3.0 arise from technical and
infrastructure overlaps, with both malware families utilizing the
same domain fronting^[3]
mechanism for hiding command-and-control (C2) traffic.

The post-exploitation-framework-as-a-service (PEFaaS) model is
the latest tool available for adversaries looking to maintain
covert access to compromised devices over an extended period of
time.

It also joins other frameworks like Manjusaka^[5]
and Alchimist^[6]
as well as legitimate and open source
alternatives^[7] such as Cobalt Strike,
Metasploit, Sliver, Empire, Brute Ratel, and Havoc that have been
co-opted for malicious ends.