1.0 Introduction
The Cyber999 Incident Response Centre has been receiving several incident reports of businesses impacted by ransomware this year. As of writing this advisory, we have received less than 10 incidents of RansomHub infection affecting businesses, including a private educational institution. It should be noted that these are only reported incidents, while those unreported could be more. Though the number may not be significant, the impacts could be devastating. The incidents may seriously impact businesses in terms of disruption to operations and potential data leaks.
The Federal Bureau of Investigation (FBI), together with the Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Department of Health and Human Services (HHS), has released a joint advisory to share RansomHub ransomware IOCs and TTP. The IOCs and TTP are essential for organisations and businesses to mitigate RansomHub ransomware.
2.0 Impact
The RansomHub encrypts files and exfiltrates data from the infected systems. It leverages a double-extortion model by encrypting systems and exfiltrating data to extort victims. The ransom note dropped during encryption provides victims a client ID and instructs them to contact the ransomware group via a unique .onion URL (reachable through the Tor browser). Victims are typically given three to 90 days to pay the ransom (depending on the affiliate) before the ransomware group publishes their data on the RansomHub Tor data leak site.
3.0 Technical Details
3.1 Leveraged Tools
See Table 1 for publicly available tools and applications used by RansomHub affiliates. This includes legitimate tools repurposed for their operations.
Disclaimer: These tools and applications should not be attributed malicious without analytical evidence to support threat actor use and/or control.
Table 1: Tools Used by RansomHub Affiliates
| Tool Name | Description |
| BITSAdmin |
A command-line utility that manages downloads/uploads between a client and server by using the Background Intelligent Transfer Service (BITS) to perform asynchronous file transfers. |
| Cobalt Strike [S0154] |
A penetration testing tool used by security professionals to test the security of networks and systems. RansomHub affiliates have used it to assist with lateral movement and file execution. |
| Mimikatz [S0002] |
A tool that allows users to view and save authentication credentials such as Kerberos tickets. RansomHub affiliates have used it to aid privilege escalation. |
| PSExec [S0029] |
A tool designed to run programs and execute commands on remote systems. |
| PowerShell |
Cross-platform task automation solution made up of a command line shell, a scripting language, and a configuration management framework, which runs on Windows, Linux, and macOS. |
| RClone |
A command line program used to sync files with cloud storage services. |
| Sliver |
A penetration testing toolset which allows for remote command and control of systems. |
| SMBExec |
A tool designed to manipulate SMB services for remote code execution. |
| WinSCP |
Windows Secure Copy is a free and open source SSH File Transfer Protocol, File Transfer Protocol, WebDAV, Amazon S3, and secure copy protocol client. Affiliates have used it to transfer data from a compromised network to actor-controlled accounts. |
| CrackMapExec |
Pentest Toolset |
| Kerberoast |
Kerberos Brute force and Exploitation Tool |
| AngryIPScanner |
Network Scanner |
3.2 Indicators of Compromise (IOCs)
Disclaimer: Several IP addresses were first observed as early as 2020, although most date from 2022 or 2023 and have been historically linked to QakBot. The Federal Bureau of Investigation (FBI), together with the Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Department of Health and Human Services (HHS), recommend organisations investigate or vet these IP addresses before taking action (such as blocking).
See Table 2–Table 5 for IOCs obtained from the FBI investigations.
Table 2: Directory Structure TTPs
| Filename | Description |
| C:\Users\%USERNAME%\AppData\Local\Programs\Python\Python311\Scripts\crackmapexec.exe |
CrackMapExec |
| C:\Users\%USERNAME%\AppData\Local\Programs\Python\Python311\Scripts\kerbrute.exe |
Kerberoasting |
| C:\Users\%USERNAME%\Downloads\Anydesk.exe |
Anydesk C2 |
| C:\Users\%USERNAME%\Desktop\IamBatMan.exe |
Ransomware |
| C:\Users\%USERNAME%\Downloads\nmap-7.94-setup.exe |
Nmap |
| C:\Program Files (x86)\Nmap\nmap.exe |
Nmap |
| C:\Users\%USERNAME%\Downloads\mimikatz_trunk\x64\mimikatz.exe |
Mimikatz |
| C:\Users\backupexec\Downloads\x64\mimikatz.exe |
Mimikatz |
Disclaimer: The Federal Bureau of Investigation (FBI), together with the Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Department of Health and Human Services (HHS), recommend network defenders investigate or vet IP addresses before taking action, such as blocking. Many cyber actors are known to change IP addresses, sometimes daily, and some IP addresses may host valid domains.
Table 3: Known IPs Related to Malicious Activity (2023-2024)
| IP Address |
| 8.211.2[.]97 |
| 45.95.67[.]41 |
| 45.134.140[.]69 |
| 45.135.232[.]2 |
| 89.23.96[.]203 |
| 188.34.188[.]7 |
| 193.106.175[.]107 |
| 193.124.125[.]78 |
| 193.233.254[.]21 |
Table 4: Known URLs Related to Malicious Activity (2023-2024)
| Web Requests |
| http[:]//188.34.188[.]7/555 |
| http[:]//188.34.188[.]7/555/ |
| http[:]//188.34.188[.]7/555/amba16.ico |
| http[:]//188.34.188[.]7/555/bcrypt.dll |
| http[:]//188.34.188[.]7/555/CRYPTSP.dll |
| http[:]//188.34.188[.]7/555/en |
| http[:]//188.34.188[.]7/555/en-US |
| http[:]//188.34.188[.]7/555/NEWOFFICIALPROGRAMCAUSEOFNEWUPDATE.exe.Config |
| http[:]//188.34.188[.]7/555/NEWOFFICIALPROGRAMCAUSEOFNEWUPDATE.INI |
| http[:]//89.23.96[.]203/ |
| http[:]//89.23.96[.]203/333 |
| http[:]//89.23.96[.]203/333/ |
| http[:]//89.23.96[.]203/333/1.exe |
| http[:]//89.23.96[.]203/333/1.exe.Config |
| http[:]//89.23.96[.]203/333/10.exe |
| http[:]//89.23.96[.]203/333/12.exe |
| http[:]//89.23.96[.]203/333/12.exe.Config |
| http[:]//89.23.96[.]203/333/2.exe |
| http[:]//89.23.96[.]203/333/2.exe.Config |
| http[:]//89.23.96[.]203/333/2wrRR6sW6XJtsXyPzuhWhDG7qwN4es.exe |
| http[:]//89.23.96[.]203/333/2wrRR6sW6XJtsXyPzuhWhDG7qwN4es.exe.Config |
| http[:]//89.23.96[.]203/333/3.exe |
| http[:]//89.23.96[.]203/333/3.exe.Config |
| http[:]//89.23.96[.]203/333/4.exe |
| http[:]//89.23.96[.]203/333/4.exe.Config |
| http[:]//89.23.96[.]203/333/5.exe |
| http[:]//89.23.96[.]203/333/5.exe.Config |
| http[:]//89.23.96[.]203/333/6.exe |
| http[:]//89.23.96[.]203/333/7.exe |
| http[:]//89.23.96[.]203/333/8.exe |
| http[:]//89.23.96[.]203/333/9.exe |
| http[:]//89.23.96[.]203/333/92.exe |
| http[:]//89.23.96[.]203/333/AmbaPDF.ico |
| http[:]//89.23.96[.]203/333/ambapdf.ico.DLL |
| http[:]//89.23.96[.]203/333/bcrypt.dll |
| http[:]//89.23.96[.]203/333/Cabinet.dll |
| http[:]//89.23.96[.]203/333/CRYPTBASE.DLL |
| http[:]//89.23.96[.]203/333/cryptnet.dll |
| http[:]//89.23.96[.]203/333/CRYPTSP.dll |
| http[:]//89.23.96[.]203/333/cv4TCGxUjvS.exe |
| http[:]//89.23.96[.]203/333/DPAPI.DLL |
| http[:]//89.23.96[.]203/333/en |
| http[:]//89.23.96[.]203/333/en/d%E5%AD%97%E5%AD%97.resources.dll |
| http[:]//89.23.96[.]203/333/en/d%E5%AD%97%E5%AD%97.resources.exe |
| http[:]//89.23.96[.]203/333/en/d%E5%AD%97%E5%AD%97.resources/d%E5%AD%97%E5%AD%97.resources.dll |
| http[:]//89.23.96[.]203/333/en/d%E5%AD%97%E5%AD%97.resources/d%E5%AD%97%E5%AD%97.resources.exe |
| http[:]//89.23.96[.]203/333/en-US |
| http[:]//89.23.96[.]203/333/en-US/d%E5%AD%97%E5%AD%97.resources.dll |
| http[:]//89.23.96[.]203/333/en-US/d%E5%AD%97%E5%AD%97.resources.exe |
| http[:]//89.23.96[.]203/333/en-US/d%E5%AD%97%E5%AD%97.resources/d%E5%AD%97%E5%AD%97.resources.dll |
| http[:]//89.23.96[.]203/333/en-US/d%E5%AD%97%E5%AD%97.resources/d%E5%AD%97%E5%AD%97.resources.exe |
| http[:]//89.23.96[.]203/333/iertutil.dll |
| http[:]//89.23.96[.]203/333/information.exe |
| http[:]//89.23.96[.]203/333/information.exe.Config |
| http[:]//89.23.96[.]203/333/information.INI |
| http[:]//89.23.96[.]203/333/IPHLPAPI.DLL |
| http[:]//89.23.96[.]203/333/mshtml.dll |
| http[:]//89.23.96[.]203/333/msi.dll |
| http[:]//89.23.96[.]203/333/SspiCli.dll |
| http[:]//89.23.96[.]203/333/TmsLA6kdcU8jxKzpMvbUVweTeF5YcR.exe |
| http[:]//89.23.96[.]203/333/TmsLA6kdcU8jxKzpMvbUVweTeF5YcR.exe.Config |
| http[:]//89.23.96[.]203/333/2wrRR6sW6XJtsXyPzuhWhDG7qwN4es.exe |
| http[:]//89.23.96[.]203/333/xwenxub285p83ecrzvft.exe |
| http[:]//89.23.96[.]203/333/cv4TCGxUjvS.exe |
| http[:]//89.23.96[.]203/333/urlmon.dll |
| http[:]//89.23.96[.]203/333/USERENV.dll |
| http[:]//89.23.96[.]203/333/webio.dll |
| http[:]//89.23.96[.]203/333/winhttp.dll |
| http[:]//89.23.96[.]203/333/WININET.dll |
| http[:]//89.23.96[.]203/333/WINMM.dll |
| http[:]//89.23.96[.]203/333/WINMMBASE.dll |
| http[:]//89.23.96[.]203/333/winnlsres.dll |
| http[:]//89.23.96[.]203/333/xwenxub285p83ecrzvft.exe |
| http[:]//89.23.96[.]203/333/xwenxub285p83ecrzvft.exe.Config |
| http[:]//temp.sh/KnCqD/superloop.exe |
| https[:]//grabify.link/Y33YXP |
| https[:]//i.ibb.co/2KBydfw/112882618.png |
| https[:]//i.ibb.co/4g6jH2J/2773036704.png |
| https[:]//i.ibb.co/b1bZBpg/2615174623.png |
| https[:]//i.ibb.co/Fxhyq6t/2077411869.png |
| https[:]//i.ibb.co/HK0jV1G/534475006.png |
| https[:]//i.ibb.co/nbMNnW4/2501108160.png |
| https[:]//i.ibb.co/p1RCtpy/2681232755.png |
| https[:]//i.ibb.co/SxQLwYm/1038436121.png |
| https[:]//i.ibb.co/v1bn9ZK/369210627.png |
| https[:]//i.ibb.com:443/V3Kj1c2/1154761258.png |
| https[:]//i.ibb.co/X2FR8Kz/2113791011.png |
| https[:]//i.ibb.com:443/V3Kj1c2/1154761258.png |
| https[:]//12301230[.]co/npm/module.tripadvisor/module.tripadvisor.css |
| https[:]//12301230[.]co/npm/module.external/jquery.min.js |
| https[:]//12301230[.]co/npm/module.external/moment.min.js |
| https[:]//12301230[.]co/npm/module.external/client.min.js< |
| https[:]//12301230[.]co/npm/module.tripadvisor/module.tripadvisor.js |
| https[:]//samuelelena[.]co/npm/module.tripadvisor/module.tripadvisor.js |
| https[:]//samuelelena[.]co/npm/module.external/jquery.min.js |
| https[:]//samuelelena[.]co/npm/module.external/moment.min.jsv\ |
| https[:]//samuelelena[.]co/npm/module.external/client.min.js |
| https[:]//samuelelena[.]co/ |
| http[:]//samuelelena[.]co/ |
| https[:]//samuelelena[.]co/npm |
| https[:]//samuelelena[.]co/npm/module.tripadvisor/module.tripadvisor.js |
| http[:]//samuelelena[.]co/npm/ |
| http[:]//samuelelena[.]co/npm/module.tripadvisor/module.tripadvisor.js |
| http[:]//samuelelena[.]co/npm/module.external/client.min.js |
| https[:]//samuelelena[.]co/npm/module.tripadvisor/module.tripadvisor. |
| https[:]//samuelelena[.]co/npm/module.external/jquery.min.js |
| https[:]//samuelelena[.]co/npm/module.external |
| https[:]//samuelelena[.]co/np |
| https[:]/samuelelena[.]co/npm/module.tripadvisor/module.tripadvisor.js |
| https[:]//samuelelena[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]js |
| https[:]//samuelelena[.]co/npm/module[.]external/client.min.js |
| https[:]//samuelelena[.]co/npm/module.external/jquery.min.js |
| http[:]//samuelelena[.]co:443/ |
| http[:]//samuelelena[.]co/npm/module.external/jquery.min.js |
| https[:]//40031[.]co/npm/module.tripadvisor/module.tripadvisor.css |
| https[:]//40031[.]co/npm/module.external/jquery.min.js |
| https[:]//40031[.]co/npm/module.external/moment.min.js |
| https[:]//40031[.]co/npm/module.external/client.min.js |
| https[:]//40031[.]co/npm/module.tripadvisor/module.tripadvisor.js |
4.0 Recommendations
CyberSecurity Malaysia recommends that system administrators review this advisory and implement the mitigations recommended below for immediate protection against RansomHub and other ransomware incidents.
4.1 Recommendations for System Administrators:
- Implement recovery plan to maintain and retain multiple copies of sensitive and proprietary data and servers in a physically separate, segmented and securelocation.
- Organisations must proactively monitor and screen for compromised credentials potentially due to RansomHub infection. Hence, compromised credentials must be immediately rectified by changing the passwords to strong passwords.
- Implementing password revocation to enforce password changing.
- Encourage employees to use secure password managers and longer passphrases, avoid using the same password for multiple accounts and set reminders to change passwords after several months.
- Use multi-factor authentication to identify and protect the businesses' critical assets and access to critical information systems.
- Restrict access authorisations according to user roles and develop authorisation policy to secure idle accounts; automatically lock accounts and alert IT staff after several failed login attempts.
- Review Active Directory (AD) to locate and close existing backdoors, such as compromised service accounts, which often have administrative privileges and are often targeted by attackers who aim to steal credentials.
- Keep all operating systems, software and firmware up-to-date and patched regularly.
- Perform Data backups daily and test regularly. Place backup copies in a remote location.
- Enforce phishing-resistant multifactor authentication to administrator accounts.
- Segment networks to prevent the spread of ransomware, which helps to restrict adversary lateral movement.
- Install, regularly update and enable real-time detection for anti-virus software on all hosts.
- Review domain controllers, servers, workstations, and active directories for new and/or unrecognised accounts.
- Maintain offline backups of data and regularly maintain backup and restoration. Ensure all backup data is encrypted
- IS awareness training should be conducted for all staff at least once a year.
- Do not download suspicious files from an unknown sender.
- Conduct Disaster Recovery Plan review and update, if necessary.
- Conduct Business Continuity Plan review and update, if necessary.
4.2 Recommendations for Internet Users:
- Users should use strong and unique passwords.
- Users should use secure passwords for the network.
- Users should be wary of phishing attempts and not simply click on any links or executables they receive via social media and other messaging applications.
- Users should practice safe browsing and regularly back up data.
- Users should download software or applications from reputable sources.
- Users should be wary and suspicious of applications circulated on social media for downloads.
- Enable and use up-to-date anti-virus software.
- Do regular security updates and patches.
- Contact relevant authorities such as CyberSecurity Malaysia for inquiries and assistance related to cyber threats or suspicious activities users observe online
- Users are also encouraged to report to the Service Providers or the social media platform concerning the circulation of posts or ads with suspicious links.
Generally, CyberSecurity Malaysia advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
To report an incident and for further enquiries, please contact the Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.mycert.org.my
5.0 References
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a
- https://www.mycert.org.my/portal/advisory?id=MA-1034.022024
- https://thehackernews.com/2024/09/ransomhub-ransomware-group-targets-210.html