• Cybercriminals are abusing Advanced Installer, a legitimate Windows tool used for creating software packages, to drop cryptocurrency-mining malware on infected machines. This activity has been ongoing since at least November 2021.
• The attacker uses Advanced Installer to package other legitimate software installers, such as Adobe Illustrator, Autodesk 3ds Max and SketchUp Pro, with malicious scripts and uses Advanced Installer's Custom Actions feature to make the software installers execute the malicious scripts.
• The software installers targeted in this campaign are specifically used for 3-D modeling and graphic design, and most of them use the French language, indicating that the victims are likely across business verticals, including architecture, engineering, construction, manufacturing, and entertainment in French language-dominant countries.
• The payloads include the M3_Mini_Rat client stub — which allows the attacker to establish a backdoor and download and execute additional threats, the Ethereum cryptocurrency-mining malware PhoenixMiner, and lolMiner, a multi-coin mining threat.
• Cybercriminals are likely exploiting these particular software installers because of their need for high Graphics Processing Unit (GPU) power to function, which adversaries rely on to mine cryptocurrency.

Victimology

The attacks predominantly target users in France and Switzerland, with a few infections in other geographic areas, including the U.S., Canada, Algeria, Sweden, Germany, Tunisia, Madagascar, Singapore and Vietnam, according to our analysis of the DNS request data sent to the attacker’s command and control (C2) host. Most of the software installers used in this campaign are written in French, supporting our observation that this campaign primarily targets French-speaking users.

The campaign likely affects business verticals such as architecture, engineering, construction, manufacturing and entertainment, as the attackers use software installers specifically created for 3-D modeling and graphic design. These industries are likely attractive targets for illicit cryptomining as they use computers with high GPU specifications and powerful graphics cards useful for generating cryptocurrency.

Campaign overview: Cybercriminals abuse Advanced Installer to execute cryptominers

Talos discovered an ongoing illicit cryptocurrency mining campaign that deploys malicious payloads by abusing the tool Advanced Installer. This is a legitimate tool designed to create software packages for Windows. However, the attackers used it to package legitimate software installers with malicious PowerShell and Windows batch scripts. These malicious scripts are executed using Advanced Installer’s Custom Action feature, which allows users to predefine custom installation tasks. The final payloads are PhoenixMiner and lolMiner, publicly available miners relying on computers’ GPU capabilities.

In the same time frame, we also observed that the attacker deployed the M3_Mini_Rat client stub using tactics, techniques and procedures (TTPs) that are highly similar to the mining activity. A stub is a piece of code that translates parameters sent between the client and server during a remote procedure. The M3_Mini_Rat client stub is a PowerShell script generated by the M3_Mini_Rat and establishes a backdoor to the victim's machine. We could not determine if this backdoor was leveraged for cryptomining, however, we assessed the activity as likely part of the same mining campaign that deployed PhoenixMiner and lolMiner. In both instances, the attacker abused Advanced Installer and its Custom Actions feature to deploy malicious scripts, and the attack sequences and naming conventions are highly similar, as detailed in the methodology section below.

Attacker’s infrastructure

Analysis of the infrastructure used in this campaign revealed location data for the attacker-controlled C2 servers and other malware deployed from these servers in previous campaigns. The C2 server had the domain sysnod[.]duckdns[.]org, which resolved to an IP 104[.]244[.]76[.]183 in Luxembourg. Based on passive DNS resolution data, we discovered the domain sysnod[.]duckdns[.]org had previously resolved to the IPs 79[.]134[.]225[.]70 and 79[.]134[.]225[.]124 in Germany. In different malicious campaigns, these servers were operated as C2 servers for various RATs, including Nanocore, njRAT and AsyncRAT, suggesting that they were likely used by the same attacker in their previous campaigns. In another iteration of this mining campaign, the attacker had a malicious download server with the IP address 51[.]178[.]39[.]184 in France, which staged the intermediate PowerShell loaders, the encrypted PowerShell launcher scripts, PhoenixMiner and lolMiner.  

The attacker has used multiple wallet addresses since the campaign began in 2021 to facilitate mining different cryptocurrencies. In this campaign, we observed the attacker using the wallet addresses “0xbEB015945E9Da17dD0dc9A4b316f8F3150d93352” and “0xbCa8d14Df89cc74B158158E55FCaF5022a103795” for Ethereum Classic (ETC) and for FLUX (ZelHash) they used “t1KHZ5Piuo4Ke7i6BXfU4” and “t1KHZ5Piuo4Ke7i6BXfU4A.” Talos’ analysis of ETC transactions in the blockchain revealed that the attacker had made cryptocurrency transfers to several other wallets from those parent wallets. Based on this data, we compiled a timeline of the attacker’s mining activity and the number of ETCs mined since November 2021.

After only mining a few Ethereum in November and December 2021, their activity took off in October 2022. In January 2023, the adversaries generated more than 50 Ethereum Classic,  and on July 9, 2023, alone mined more than 50 (the equivalent of about $800 USD based on current values).

Two methodologies used to establish a backdoor or implant cryptominers

Talso discovered two multi-stage attack methodologies the attacker employed in this campaign. The first methodology shows how the M3_Mini_Rat client stub was installed and used to establish a backdoor to the victim’s machine. The second outlines how PhoenixMiner and lolMiner were implanted for cryptomining. We could not determine how the trojanized software installers were initially delivered to the victims’ machines. In the past, we have commonly seen such trojanized installers delivered using the search engine optimization (SEO) poisoning technique.

Attack method 1: Installing M3_Mini_Rat client stub

The attack sequence is initiated when a victim clicks on a legitimate software installer, which the attacker bundled with a malicious script using Advanced Installer. The installer then drops a malicious batch script named “core.bat” and the legitimate PE executable “viewer.exe,” an Advanced Installer component as “MSI72E2.tmp” in the local user profile application data temporary folder. To execute the malicious script, the attackers abused Advanced Installer’s Custom Action feature by including command-line arguments to execute the dropped malicious batch file.

During the installation process, msiexec.exe, an executable program of the Windows Installer used to interpret installation packages and install products on target systems, runs  “MSI72E2.tmp (viewer.exe)” with the configured command-line arguments, which executes the malicious batch script. The example identified while analyzing the sample in our sandbox is shown below:

Then, the software installer creates a folder called “webgard” in the local user profile roaming folder, and drops a malicious PowerShell loader script named “cor.ps1” (PS-1) and an encrypted file named “core.bin” which is the M3_Mini_RAT client stub.

The malicious batch script “core.bat”, which was dropped during the initial execution stage of the software installer, contains a command to configure the task scheduler in the victim’s machine. It creates a task named “ViGEmBusUpdater” that runs every minute to execute the malicious PowerShell loader script in the “webgard” folder. The attacker may have chosen the name “ViGEmBusUpdater” to evade detection by masquerading as the legitimate “ViGEmBusUpdater” executable. The task scheduler command is shown below:

The "ViGEmBusUpdater" task executes the malicious PowerShell loader script and decrypts the encrypted file “core.bin” to generate the M3_Mini_Rat client stub and run it in the victim’s machine memory. The M3_Mini_Rat client stub attempts to connect to the C2, however, during our analysis, the C2 was unresponsive, so we were unable to observe any subsequent payloads deployed, particularly cryptominers.

Attack method 2: Installing PhoenixMiner and lolMiner

In the second method, the attacker also abuses Advanced Installer and its Custom Actions feature to drop malicious batch scripts. As in method one, user interaction is required to run the software installer that has been bundled using Advanced Installer, which drops “viewer.exe” as a temporary file with a random filename and “core.bat” in the local user profile application data temporary folder. The second method is slightly different, as the installer is also bundled with a second batch script called “win.bat” that is dropped and saved alongside the other files. Then, “viewer.exe” executes the two dropped batch files based on the Custom Action commands, as previously outlined.

Another similarity between the two methods is that the software installer creates a folder, in this instance called “Winsoft,” in the local user roaming profile and drops a malicious PowerShell loader script “core.ps1” (PS-1) and an encrypted file “core.bin” (ENC-1).

The malicious batch script “win.bat” configures the task scheduler by creating a task “MSI Task Host - Detect_Monitor” to run every two hours to execute the malicious PowerShell loader script “core.ps1” (PS-1)  from the location “%appdata%\winsoft.” The task scheduler commands executed by “win.bat” are shown below.

When the scheduled task “MSI Task Host - Detect_Monitor” is run, the PowerShell loader script (PS-1) is executed, which decrypts the encrypted file “core.bin” (ENC-1), generating and executing a PowerShell downloader script.

The PowerShell downloader downloads a malicious ZIP archive from an attacker-controlled server to the %windir% location on the victim’s machine. It unzips its contents to drop another PowerShell loader script “core.ps1” (PS-2), an encrypted file (ENC-2), and an Ethash miner called PhoenixMiner executable with “svhost.exe” as the filename.

The malicious batch script, “core.bat,” has the command to create the task “ViGEmBusUpdater” and configures it to run every minute to execute the downloaded PowerShell loader script (PS-2) from the location %windir%. The task scheduler commands executed by core.bat are shown below.

The downloaded PowerShell loader script (PS-2) is executed from the %windir% location when the scheduled task “ViGEmBusUpdater” runs which will decrypt the dropped encrypted file (ENC-2) to generate and execute a PowerShell launcher script in the victim’s system memory.

The PowerShell launcher runs PhoenixMiner from the victim machine’s Windows systems folder with the Ethereum Classic mining parameters. The attacker uses the filename “svhost.exe,” which closely matches the legitimate Windows executable filename “svchost.exe” in the Windows systems folder, possibly trying to go unnoticed or undetected by the malicious process-scanning engines of endpoint security products.

In our analysis of another trojanized software installer sample, the attack chain remains the same as the second attack method except for the payload, which is the lolMiner. The attacker gave lolMiner the file name “svshost.exe,” possibly to masquerade as “svchost.exe,”  dropped it in the location %windir%, and ran it using the PowerShell launcher script for FLUX (ZelHash) mining.

Payloads

The payloads delivered in this campaign are an M3_Mini_Rat client, an Ethash miner called PhoenixMiner, or lolMiner.

M3_Mini_Rat Client to establish a backdoor

M3_Mini_Rat client is a PowerShell script with remote administration capabilities that mainly focuses on performing system reconnaissance and downloading and executing other malicious binaries. The RAT client is built with a builder associated with the administration panel for M3_Mini_Rat, a .Net application whose author is called “Mr3.” Version 0.1 is currently the only one in the wild. The RAT uses its administration panel to perform remote administration activities on the victim’s machine via the RAT client after successfully implanting the RAT client stub. From the administration panel, the RAT can perform several remote administration functionalities, including File System activities, capturing screenshots, executing arbitrary commands, and sending files to the victim’s machine by loading them into the victim’s system memory or dropping them in the filesystem.

When executed in the victim’s system memory, the RAT client stub connects to the command and control server by establishing a TCP connection on port 3434. Once successfully connected, an attacker can perform remote administration tasks shown in the M3_Mini_Rat administration panel and send commands for the RAT client to serve.

The RAT client can execute the following commands:

PhoenixMiner to mine ETC

PhoenixMiner is an Ethash (ETH, ETC, Musicoin, EXP, UBQ, etc.) miner that supports AMD and Nvidia cards and works on the Ethash cryptocurrency algorithm. When executed, it utilizes the victim’s computer GPU power to mine Ethash. It is publicly available to download through the URL hxxps[://]phoenixminer[.]org.

In this campaign, the attacker uses the cryptocurrency mining pool parameters for the PhoenixMiner, as shown below:

lolMiner to mine Flux

lolMiner is a cryptocurrency miner that uses the GPU capabilities of the computers to mine a variety of cryptocurrencies. It supports AMD, Nvidia and Intel cards. The LolMiner identified in this campaign is version 1.76, publicly available on GitHub. It can also mine two different cryptocurrencies at the same time.

The attacker in this campaign uses lolMiner to mine the FLUX (ZelHash) using the mining parameters shown below:

Coverage

Cisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.

Cisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.

Cisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.

Cisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.

Cisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.

Umbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.

Cisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.

Additional protections with context to your specific environment and threat data are available from the Firewall Management Center.

Cisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.

Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat is 62325.

ClamAV detections are available for this threat:

Win.Backdoor.M3MiniRAT-10007342-0

Win.Trojan.MaliciousInstaller-10007344-0

Win.Loader.PowerShellDecrypter-10007381-0

Win.Trojan.MaliciousInstaller-10007345-0

Win.Coinminer.PhoenixMiner-10007386-0

Win.Coinminer.lolMiner-10007385-0

Orbital Queries

Cisco Secure Endpoint users can use Orbital Advanced Search to run complex OSqueries to see if their endpoints are infected with this specific threat. For specific OSqueries related to this threat, please follow the link here.

Indicators of Compromise

Indicators of Compromise associated with this threat can be found here.

Ransomware gangs are consistently rebranding or merging with other groups, as highlighted in our 2022 Year in Review, or these actors work for multiple ransomware-as-a-service (RaaS) outfits at a time, and new groups are always emerging.

This trend is already continuing this year. Since 2021, there have been multiple leaks of ransomware source code and builders — components that are essential to creating and modifying ransomware. This has had a significant effect on the threat landscape, giving unsophisticated actors the ability to easily generate their own ransomware with little effort or knowledge. As more actors enter this space, Cisco Talos is seeing an increasing number of ransomware variants emerge, leading to more frequent attacks and new challenges for cybersecurity professionals, particularly regarding actor attribution.

Code leaks are benefitting threat actors

Since September 2021, we have seen actors publicly disclosing source code and builders for prominent ransomware families, including Babuk, Conti, LockBit 3.0 and Chaos. In some cases, such as LockBit 3.0’s ransomware builder, these leaks have been intentional, with affiliates posting these tools and codes to protest against broader group policies they are unhappy with. In other instances, such as the Babuk source code, the leaks were seemingly an operational error. Regardless of the cause, these leaks are having a significant effect on the threat landscape, making it easier for novice or unskilled actors to develop their own ransomware variants without much effort or knowledge.

Ransomware source code is a malicious program that contains the instructions and algorithms that define the ransomware’s behavior. It is usually complex and often requires skilled technicians to create. Therefore, having access to such code allows threat actors with minimum programming knowledge to modify and compile their own ransomware variants.

Ransomware builders usually have a user interface that allows users to choose the underlying features and customize the configurations to build a new ransomware binary executable without exposing the source code or needing a compiler installed. The availability of such builders allows novice actors to generate their own customized ransomware variants. An example of a leaked Chaos ransomware builder V5 is shown in the picture below.

When ransomware source code or builders are leaked, it becomes easier for aspiring cybercriminals who lack the technical expertise to develop their own ransomware variants by making only minor modifications to the original code. Additionally, by using leaked source code, threat actors can confuse or mislead investigators, as security professionals may be more likely to misattribute the activity to the wrong actor.

New variants based on leaked code are becoming more common

We have continued seeing various malicious campaigns since the start of 2023, where the threat actors have used new ransomware variants based on leaked source code or builders. Early this year, Talos discovered a new ransomware family called MortalKombat generated by the leaked Xorist ransomware builder. Xorist ransomware, which operates under the RaaS model, has a builder called “Encoder Builder v.24” that is available on underground forums. Based on our research, we discovered an unknown threat actor using MortalKombat ransomware since December 2022 to target individuals and smaller companies. This campaign has a multi-stage attack chain that begins with a phishing email delivered to victims impersonating CoinPayments, a legitimate global cryptocurrency payment gateway.

In April, Talos discovered a new ransomware actor, RA Group, conducting double extortion attacks using their ransomware variant based on leaked Babuk source code. Babuk, a Russian ransomware group that emerged in 2021, has conducted a series of high-profile ransomware attacks across various industries, including government, healthcare, logistics, and professional services. Since an alleged member of the Babuk group leaked the full source code of its ransomware in September 2021, several new variants based on the leaked code have emerged, with many appearing in 2023, including ESXiArgs, Rorschach and RTM Locker, in addition to RA Group. RA Group, in its ongoing campaigns, has targeted the U.S., South Korea, Taiwan, the U.K. and India across several business verticals, including manufacturing, wealth management, insurance providers, pharmaceuticals and financial management consulting companies.

Most recently, Talos observed a surge in new ransomware strains emerging from the Yashma ransomware builder. Yashma ransomware builder, which first appeared in May 2022, is a rebranded version of the Chaos ransomware builder V5, which was leaked in April 2022. Since early 2023, we have seen several new Yashma strains emerge, including ANXZ, Sirattacker, and Shadow Men Team. Shadow Men Team — whose name we derived from a translation of their Hindi name in the ransom note — appears to be a new actor in the ransomware space. The actors appear to target victims in Kuwait, as the ransom note demands payment in Kuwaiti dinar before translating that sum to its U.S. dollar equivalent in Bitcoin.

Another new actor we discovered, seemingly of Vietnamese origin, uses a Yashma ransomware variant to target victims in Bulgaria, China, Vietnam and other countries. The campaign started in at least June 2023, and the ransom note appears to mimic certain aspects of the ransom note used in the global WannaCry attacks from 2017.

Actors repurposing leaked code are demanding low ransom payments

Cybercriminals leveraging leaked code and builders are seemingly more conservative in their ransom demands, a possible indication that they are lone wolf operators, proceeding cautiously as they test their new variants or are new players in this space. Actors behind many of these new ransomware variants, including Sirattacker, Chaos 2.0, Chaos 4.0, DCrypt, and Shadow Men Team, are demanding payments ranging from USD $3.50 to $4,390 in Bitcoin from victims. These ransom demands are significantly lower than those made by many well-known ransomware gangs like RYUK, Babuk, REvil, Conti, DarkSide, BlackMatter, BlackCat, and Yanluowang, which are typically in the millions of dollars. These more profitable groups usually operate under the RaaS model, meaning their affiliates are free to set their own (often high) ransom demands, and/or are structured so they pay their operators and developers, thereby driving up the amount of money they seek to take in during the course of their operations.

Below is a comparison of ransom demands made by actors using leaked code or builders and well-known ransomware gangs.

Opportunities for security researchers and defenders

While these changes in the threat landscape have largely benefitted threat actors, security researchers and defenders also have an advantage with access to the leaked code. It allows security researchers to analyze the source code and understand the attacker’s tactics, techniques and procedures (TTPs), which helps security professionals develop effective detection rules and enhance security products' capabilities in combating ransomware threats.

By analyzing the source code, researchers can identify similar patterns and techniques used by different threat actors, providing defenders with a way to proactively detect and block the new variants at the initial stage of an attack. Security researchers can also share the intelligence information derived from the leaked code with the broader security community, thereby contributing to strengthening the cybersecurity space. By understanding the TTPs of the leaked source codes, defenders will gain invaluable insights that are helpful in identifying and mitigating any existing security weakness in their environment and improving their security defense against these attack vectors.

• Cisco Talos discovered an unknown threat actor, seemingly of Vietnamese origin, conducting a ransomware operation that began at least as early as June 4, 2023.
• This ongoing attack uses a variant of the Yashma ransomware likely to target multiple geographic areas by mimicking WannaCry characteristics.
• The threat actor uses an uncommon technique to deliver the ransom note. Instead of embedding the ransom note strings in the binary, they download the ransom note from the actor-controlled GitHub repository by executing an embedded batch file.

Threat actor analysis

Talos assesses with high confidence that this threat actor is targeting victims in English-speaking countries, Bulgaria, China and Vietnam, as the actor’s GitHub account, “nguyenvietphat,” has ransomware notes written in these countries’ languages. The presence of an English version could indicate the actor intends to target a wide range of geographic areas.

Talos assesses with moderate confidence that the threat actor may be of Vietnamese origin because their GitHub account name and email contact on the ransomware notes spoofs a legitimate Vietnamese organization’s name. The ransom note also asks victims to contact them between 7 and 11 p.m. UTC+7, which overlaps with Vietnam’s time zone. We also spotted a slight difference in the Vietnamese language ransom note, as it starts with, “Sorry, your file is encrypted!” in contrast to the others that begin with, “Oops, your files are encrypted!” By saying “sorry,” the threat actor may have intended to show a heightened sensitivity toward victims in Vietnam, which could indicate the attackers themselves are Vietnamese.

We further assess the threat actor began this campaign around June 4, 2023, because they joined GitHub and created a public repository called “Ransomware” on that date, which overlaps with the compilation date of the ransomware binary. In the repository, they added ransom note text files in five languages: English, Bulgarian, Vietnamese, Simplified Chinese and Traditional Chinese.

Ransom note

The actor demands the ransom payment in Bitcoins to the wallet address “bc1qtd4qv0wmgtu2rdr0wr8tka2jg44cgmz04z5mc7” and they double the ransomware price if the victim fails to pay within three days, according to our ransomware note analysis. The actor has an email address, “nguyenvietphat[.]n[at]gmail[.]com,” for the victims to contact them. At the time of our analysis, we had not observed any Bitcoin in the wallet, and the ransom note did not specify an amount, indicating the ransomware operation might still be in a nascent stage.

The ransom note text resembles the well-known WannaCry ransom note, possibly to obfuscate the threat actor’s identity and confuse incident responders.

Ransom notes samples of the Yashma variant.

After encryption, the Yashma ransomware variant sets the wallpaper on the victim’s machine, as seen in the image below. It seems that the operator downloaded this picture from www[.]FXXZ[.]com and embedded it in the Yashma variant binary. The wallpaper set by the Yashma variant in the victim’s machine also mimics the WannaCry ransomware.

Yashma variant wallpaper (left) and WannaCry wallpaper (right).

Customized Yashma ransomware variant

The actor deployed a variant of Yashma ransomware, which they compiled on June 4, 2023.  Yashma is a 32-bit executable written in .Net and a rebranded version of Chaos ransomware V5, which appeared in May 2022. In this variant, most of Yashma’s features remained unchanged and have been described by the security researchers at Blackberry, with the exception of a few notable modifications.

Usually, ransomware stores the ransom note text as strings in the binary. However, this variant of Yashma executes an embedded batch file, which has the commands to download the ransom note from the actor-controlled GitHub repository. This modification evades endpoint detection solutions and anti-virus software, which usually detect embedded ransom note strings in the binary.

Earlier versions of the Yashma ransomware established persistence on the victim machine in the Run registry key and by dropping a Windows shortcut file pointing to the ransomware executable path in the startup folder. The variant we observed also established persistence in the Run registry key. Still, it was modified to create a “.url” bookmark file in the startup folder that points to the dropped executable located at “%AppData%\Roaming\svchost.exe”.

One notable feature the threat actor chose to keep in this variant is Yashma’s anti-recovery capability. After encrypting a file, the ransomware wipes the contents of the original unencrypted files, writes a single character “?” and then deletes the file. This technique makes it more challenging for incident responders and forensic analysts to recover the deleted files from the victim’s hard drive.

Coverage

Cisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.

Cisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.

Cisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.

Cisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.

Cisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.

Umbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.

Cisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.

Additional protections with context to your specific environment and threat data are available from the Firewall Management Center.

Cisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.

Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat are 62131 - 62143 and 300633 - 300638.

ClamAV detections are available for this threat:

Win.Ransomware.Hydracrypt-9878672-0

Cisco Secure Endpoint users can use Orbital Advanced Search to run complex OSqueries to see if their endpoints are infected with this specific threat. For specific OSqueries on this threat, click here.

IOCs

Indicators of Compromise associated with this threat can be found here.