Full Report
No sleep until the Cybercrime Fighters Club is done with finding the answer as to who is behind this new ransomware-as-a-service affiliate.
Analysis Summary
Based on the provided technical indicators and the context of the "Cybercrime Fighters Club" investigation, here is the structured threat actor summary.
# Threat Actor: Unnamed Ransomware-as-a-Service (RaaS) Affiliate
## Attribution & Identity
* **Actor Identification:** A high-volume affiliate operating under a Ransomware-as-a-Service (RaaS) model.
* **Known Associations:** While a specific group name is not explicitly titled in the provided snippet, the infrastructure pattern (e.g., impersonation of Microsoft, Kaspersky, and Palo Alto) is consistent with sophisticated initial access brokers or established RaaS affiliates like those previously associated with **Conti**, **LockBit**, or **BlackCat (ALPHV)**.
* **Identity Status:** The investigation by the Cybercrime Fighters Club is ongoing to finalize the link between this infrastructure and a known named entity.
## Activity Summary
* **Recent Campaigns:** The actor is actively deploying new ransomware strains using a vast network of Command and Control (C2) servers. The operations are characterized by the registration of domains that spoof legitimate software updates and cybersecurity vendors to maintain persistence and evade detection.
## Tactics, Techniques & Procedures
* **Masquerading:** Extensive use of typosquatted domains to impersonate legitimate services (Windows Update, Kaspersky, Palo Alto). [T1036]
* **Infrastructure Obfuscation:** Use of a wide range of IP addresses across different subnets to host C2 and delivery mechanisms, likely to avoid easy IP-based blocking.
* **System Services/Persistence:** Creation of malicious services mimicking legitimate system processes (e.g., `svchostsreg[.]com`, `vm3dservice[.]com`). [T1543.003]
* **Software Deployment:** Use of fake "software updates" to deliver payloads. [T1204.002]
## Targeting
* **Sectors:** High-tech, Infrastructure, and Electric/Energy (implied by domain `aerosunelectric[.]com`).
* **Geography:** Global distribution based on the IP diversity (APAC, EU, NA, MEA, and LATAM regions).
* **Victims:** Users seeking software updates and organizations with misconfigured external-facing assets.
## Tools & Infrastructure
* **Malware Families:** Ransomware (RaaS affiliate model).
* **Infrastructure (Defanged):**
* **Typosquatting Domains:**
* `msupd.wimdowupdate[.]com`
* `cache01.micnosoftupdate[.]com`
* `upd232.windowservicecentar[.]com`
* `d4ng3r.s01kaspersky[.]com`
* `paloaltocloud[.]online`
* **C2/Command Infrastructure:**
* `179.60.146[.]5`
* `193.142.30[.]205`
* `45.227.253[.]30`
* `5.188.86[.]206`
* `81.19.136[.]249`
## Implications
This actor represents a significant threat due to their organized approach to infrastructure management. By spoofing cybersecurity brands (Kaspersky/Palo Alto), they target the very trust mechanisms organizations rely on for safety. Their ability to manage dozens of distinct C2 nodes suggests a well-funded operation with high operational tempo, typical of top-tier ransomware affiliates.
## Mitigations
* **DNS Filtering:** Block all communication to the identified typosquatted domains and `.xyz` TLDs if not required for business.
* **Host-Based Monitoring:** Monitor for unusual service registrations or executions from directories like `AppData` or `Temp` that attempt to mimic `svchost.exe` or `vmnat.exe`.
* **Egress Filtering:** Restrict outbound traffic to known-good IP ranges and implement strict inspection on traffic directed toward the IP addresses listed in the infrastructure section.
* **Update Verification:** Ensure all system and security software updates are managed through centralized, verified deployment tools (e.g., WSUS, SCCM) rather than manual downloads from the web.