When you experience a breach, time is crucial. Our 24/7 Security Operations Center responds immediately with precision to eliminate the threat and restore operations.
Your organization has cybersecurity weaknesses and vulnerabilities you don’t yet even know about. They need to be found and found immediately. If you don’t someone else will.
MountLocker Ransomware Utilizing Windows Active Directory APIs
SpearTip | May 19th, 2021
The MountLocker ransomware operation that began in July 2020 as a Ransomware-as-a-Service (RaaS) is now utilizing Windows Active Directory APIs to work its way through networks.
Details of MountLocker Ransomware
MalwareHunterTeam is credited for sharing a sample of a MountLocker executable which contains a new worm feature that allows it to move throughout networks and encrypt 0ther devices on it. XingLocker, a group that uses a customized version of MountLocker executables, is where the sample originated.
The worm can be enabled by running the sample with a /NETWORK command-line argument. However, without a Windows domain, the sample will fail. More analysis of the sample by security researchers revealed the Windows Active Directory Service Interfaces API to spread throughout networks. The MountLocker ransomware uses the NetGetDCName() function in order to retrieve the name of the domain controller. After the name is retrieved, it performs LDAP queries against the domain controller’s ADS using the ADsOpenObject() function with credentials on passed on the command line.
After connecting to Active Directory services, it goes through the database for objects of ‘objectclass=computer’. MountLocker ransomware will then attempt to copy the ransomware executable to the remote device’s ‘\C$\ProgramData’ folder. The MountLocker ransomware will then remotely create a Windows service to load the executable and encrypt the device.
By utilizing this API, the ransomware can move laterally and find all devices that are part of the compromised Windows domain and encrypt those with stolen domain credentials as well.
This isn’t the first time this API has been seen in malware, as TrickBot uses it, but it could be the first instance of “corporate ransomware for professionals” to use these APIs to carry out built-in reconnaissance and spread throughout networks.
SpearTip’s engineers are dedicated to protecting networks from innovative threat actors. As these threat actors are always trying to improve their attack methods and processes, our team is improving defenses. It’s a tough task to keep up with the ever-changing threat landscape, but the continuous learning among our team allows us to stay ahead of these persistent threats.
A Security Operations Center as a Service (SOCaaS) is one of the best ways to begin protecting your organization. When issues arise, you’ll be able to communicate directly with the engineers in our US-based SOC. This in combination with our proprietary ShadowSpear Platform will allow your organization to clearly understand your risk profile. There is no better tandem in the cyber industry for incident response, so call our SOC today to be protecting your company’s profits.
Our team will continuously monitor environments 24/7 in our US-based Security Operations Center. Our certified engineers work in unison with our proprietary endpoint detection and response tool, ShadowSpear®. This allows your organization to have direct communication with our engineers at any moment and a completely transparent view of your risk profile.
If you think your organization has been breached, call our Security Operations Center at 833.997.7327.
View our articles that cover trending topics in cybersecurity with insights from our 24/7/365 Security Operations Center.
ShadowSpear Platform
Cybersecurity actors are working around the clock, shouldn’t your security team be too? Technology solutions and security controls fail for a number of reasons, poor deployment, improper implementation, or just no one monitoring the alerts.
ShadowSpear Demo
Experience ShadowSpear for yourself. Our lightweight, integrated solution will help you sleep easier at night and provide immediate confidence in your security posture.
