Full Report
Huntress has observed a new ransomware variant, Crux, being used in multiple incidents.
Analysis Summary
# Tool/Technique: Crux Ransomware
## Overview
Crux is a newly discovered ransomware variant first observed by Huntress in July 2024. The threat actors behind this malware claim an affiliation with the **BlackByte** ransomware group. Crux typically targets corporate environments, utilizing living-off-the-land binaries (LOLBins) to disable recovery options before encrypting data and demanding a ransom via specialized onion-mail addresses.
## Technical Details
- **Type:** Malware family (Ransomware)
- **Platform:** Windows
- **Capabilities:** Data encryption, disabling system recovery, data exfiltration, lateral movement, and defense evasion.
- **First Seen:** July 4, 2024
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1078 - Valid Accounts]
- [T1133 - External Remote Services (RDP)]
- **[TA0008 - Lateral Movement]**
- [T1021.001 - Remote Desktop Protocol]
- **[TA0005 - Defense Evasion]**
- [T1055 - Process Injection (via svchost.exe)]
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
- [T1027 - Obfuscated Files or Information (Unsigned binaries)]
- **[TA0040 - Impact]**
- [T1486 - Data Encrypted for Impact]
- [T1490 - Inhibit System Recovery]
## Functionality
### Core Capabilities
- **File Encryption:** Encrypts user files and appends the `.crux` extension.
- **Recovery Inhibition:** Utilizes `bcdedit.exe` to set `bootstatuspolicy` to `ignoreallfailures`, effectively disabling Windows automatic recovery features.
- **Persistence/Execution:** Deploys via unsigned executables launched with organization-specific identifiers and arguments (`-a` or `-s`).
### Advanced Features
- **Process Masquerading:** Injects or spawns a legitimate `svchost.exe` process to carry out malicious activities, making the behavior appear as standard Windows service activity.
- **Credential Theft:** Observed performing remote Registry dumps to harvest credentials.
- **Data Exfiltration:** Integrates third-party tools like `Rclone` to sync stolen data to cloud storage (e.g., Mega.nz).
- **Driver Manipulation:** Evidence of kernel-mode driver installation to potentially bypass security software.
## Indicators of Compromise
- **File Names:**
- `crux_readme_[random].txt` (Ransom note)
- `Unrips.exe` (Observed variant name)
- `cfxdlfvk.sys` (Observed driver name)
- **Network Indicators:**
- `BlackBCruxSupport[@]onionmail.org` (Support Email)
- `mega[.]nz` (Exfiltration destination)
- **Behavioral Indicators:**
- `svchost.exe` running with unconventional arguments: `-a [ID]` or `-s [ID]`.
- Command: `cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures`.
- Process tree: `[Unsigned Binary] -> svchost.exe -> cmd.exe -> bcdedit.exe`.
## Associated Threat Actors
- **BlackByte Affiliates:** The ransom notes explicitly claim the variant is "a part of the BlackByte group."
## Detection Methods
- **Signature-based:** Monitoring for the specific `.crux` extension and `crux_readme` file naming patterns.
- **Behavioral Detection:**
- Alert on `bcdedit` commands that modify `bootstatuspolicy`.
- Monitor `svchost.exe` for unexpected parent processes (especially unsigned binaries) and non-standard command-line arguments.
- Detect unauthorized use of `Rclone` or similar synchronization tools to known cloud storage providers.
- **Registry Monitoring:** Watch for `lsass.exe` or `svchost.exe` attempting to dump the HKLM\SAM or HKLM\SYSTEM hives.
## Mitigation Strategies
- **RDP Hardening:** Disable RDP where not required; implement Multi-Factor Authentication (MFA) and Use Gateway/VPN for necessary remote access.
- **Endpoint Protection:** Enable tamper protection and ensure EDR/AV solutions are configured to block unauthorized driver installations and Registry dumping.
- **Backup Integrity:** Maintain offline, immutable backups to counter the disabling of local system recovery (VSS/BCD).
- **Least Privilege:** Restrict administrative privileges to prevent the execution of `bcdedit` and the installation of kernel drivers.
## Related Tools/Techniques
- **BlackByte Ransomware:** Shares branding and likely TTPs/infrastructure.
- **Rclone:** Used for exfiltration.
- **Living-off-the-Land (LotL):** Heavy reliance on `bcdedit.exe` and `svchost.exe`.