{"id":6896,"date":"2021-08-25T16:04:34","date_gmt":"2021-08-25T23:04:34","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=6896"},"modified":"2024-08-07T12:20:12","modified_gmt":"2024-08-07T19:20:12","slug":"onepercent-group-ransomware-campaign","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/onepercent-group-ransomware-campaign\/","title":{"rendered":"OnePercent Group Ransomware Campaign"},"content":{"rendered":"

Author: Laksh Sethi<\/strong><\/h3>\n

 <\/p>\n

1. Executive Summary<\/h3>\n

On 23 August, the Federal Bureau of Investigation (FBI) released a flash alert1<\/sup> about an ongoing campaign conducted by the OnePercent Group: a group that has been using Cobalt Strike to launch ransomware attacks against U.S. companies since November 2020. The alert also provides a list of indicators of compromise (IOCs) associated with the campaign.<\/p>\n

2. Analysis<\/h3>\n

The actors use phishing emails with a malicious ZIP attachment that contains a Microsoft Word or Excel file. Opening the attachment activates macros that infect a victim\u2019s computer with the IcedID banking trojan.2<\/sup> When the actors activate the trojan (in some cases a month after the infection), it installs and runs Cobalt Strike, which uses PowerShell remoting to migrate laterally to other systems on the infected network. The actors then employ rclone,3<\/sup> a Windows-native backup utility, to encrypt and exfiltrate data from the victim\u2019s systems.<\/p>\n

Somewhere on the infected network, the actors leave a ransom note and contact information, which is a link to the actors\u2019 website accessible through the Onion Router (TOR)4<\/sup> application. The note demands that the organization pay the ransom to a Bitcoin address controlled by the group. The note also states that the actors will provide the decryption key within 48 hours of receiving the payment they have demanded.<\/p>\n

After the actors contact the organization, they wait for a week, and then proceed to barrage the organization with phone calls and emails. In addition, they repeatedly demand that the person who initially opened the attachment connect them with the organization\u2019s designated negotiator. If the organization does not respond within a week, the actors send ProtonMail email and make calls from spoofed phone numbers to warn the organization that unless the ransom is paid, the exfiltrated data will be leaked via the TOR network and clearnet. If the organization fails to respond, the actors start leaking the exfiltrated data in small increments, until they receive a response or payment.
\nThe actors use the following tools:<\/p>\n