SamSam is a targeted ransomware attack which incorporates custom infection using a wide range of exploits or brute force tactics. The ransomware is also known as Samas or SamsamCrypt. The first version of the ransomware was released in late 2015. The SamSam ransomware attacks do not make use of phishing or malware downloads to infect a network; instead they utilize following modes of infection:
- Vulnerabilities in Remote Desktop Protocols (RDP)
- Vulnerabilities in Java based web servers
- Vulnerabilities in File Transfer Protocol (FTP)
- Brute force against weak passwords
- Stolen login credentials
Once, the ransomware has initial foothold on the victim’s network, it compromises the network to gain control. Also, SamSam is a manual attack. Thus, in case an application detects the ransomware, the attackers modify a registry entry to disable the endpoint tool’s detection. This enables them to compromise the application and control the network. SamSam uses a number of applications to accomplish the attack such as Mimikatz, reGeorg, PsExec, PsInfo, RDPWrap, NLBrute, Impacket, CSVDE, PowerSploit and JexBoss.
During the reconnaissance phase, the attackers try to write a plain text file named test.txt to target. If successful, they add the target to a list titled alive.txt on Domain Controller (DC). After ensuring that DC has writing privileges for machines, the ransomware is deployed and pushed to all the machines controlled by DC simultaneously.
The ransomware follows an efficient approach for encrypting the files on infected machines.
- The encryption is initiated on holidays, weekends or late nights to buy time for maximizing the impact before getting noticed.
- Files with selective extensions or important files required for running the machines are encrypted first.
- The remaining applications or files are encrypted later; starting from smaller files and gradually moving towards larger files.
- A unique AES key is generated for every encrypted file.
- As soon as encryption is complete, ransomware deletes its installer and removes any traces of the attack.
- It becomes difficult for victims to download files from off shore backup because the applications required to run the machine are also inaccessible. Thus, they are required to go thorough time consuming process of reloading the disk and installing applications before downloading back up files.
A ransom note is left on target organization’s machines demanding a set amount of bitcoin currency to decrypt a single machine and a lump sum amount for decrypting all the machines at once. Every victim is provided a unique web address on dark web which leads to chat feature for communicating with the attackers. The chat is deleted after a victim pays the ransom.
Security Practices To Prevent SamSam Attack:
- Regularly install available patches for RDP service. Also, disable the service when not needed by the users.
- Ensure that no RDP ports are left open during interactions between cloud-based virtual machines and public IPs. If it is required to leave RDP Port of a system open, keep the system behind firewall and instruct users to communicate with this machine via VPN.
- Enable, two-factor authentication, strong passwords and account lockout policies.
For more information on how to secure your network, call Centex Technologies at (254) 213 – 4740.
