Full Report
Huntress found a previously unseen ransomware variant called Obscura on a victim company’s domain controller.
Analysis Summary
# Tool/Technique: Obscura Ransomware
## Overview
Obscura is a recently discovered ransomware variant, first identified by Huntress in late August 2025. Developed in Go, it is designed to encrypt victim files and disable system recovery features. In observed incidents, the ransomware was deployed via domain controllers and utilized the NETLOGON share to facilitate network-wide distribution and execution.
## Technical Details
- **Type:** Ransomware
- **Platform:** Windows (Go-based binary)
- **Capabilities:** File encryption, shadow copy deletion, persistence via scheduled tasks, privilege escalation checks, and lateral movement facilitation.
- **First Seen:** August 29, 2025
## MITRE ATT&CK Mapping
- **[TA0008 - Lateral Movement]**
- [T1570 - Lateral Tool Transfer]
- **[TA0003 - Persistence]**
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- **[TA0005 - Defense Evasion]**
- [T1070.004 - Indicator Removal: File Deletion]
- [T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- [T1083 - File and Directory Discovery]
- **[TA0040 - Impact]**
- [T1486 - Data Encrypted for Impact]
- [T1490 - Inhibit System Recovery]
## Functionality
### Core Capabilities
- **File Encryption:** Employs a hardcoded 32-byte public key (base64-encoded) to encrypt files across the system.
- **Inhibit Recovery:** Executes `vssadmin delete shadows /all /quiet` to prevent victims from restoring data via Volume Shadow Copies.
- **System Reconnaissance:** Enumerates all storage devices and calculates drive capacities to map the system for encryption.
- **Self-Replication/Distribution:** Leverages the `NETLOGON` share on domain controllers to ensure the binary is replicated across all domain controllers in the environment.
### Advanced Features
- **Daemon Mode Execution:** Uses an environment variable check (`DAEMON=1`) to trigger the encryption engine.
- **Administrative Check:** Uses `AllocateAndInitializeSid` and `CheckTokenMembership` Windows APIs to verify if the process has local administrator privileges.
- **Environment Mimicry:** The executable is often renamed to match the target domain name to blend into legitimate system traffic and files.
## Indicators of Compromise
- **File Names:** `README_Obscura.txt` (Ransom note), `README-OBSCURA.txt`.
- **Registry Keys:** (Not explicitly detailed in source, but involves environment variable `DAEMON`).
- **Network Indicators:** (The specific executable name was withheld to protect the victim, but it typically mimics the internal domain name).
- **Behavioral Indicators:**
- Creation of a scheduled task named `SystemUpdate`.
- Creation of a scheduled task named `iJHcEkAG`.
- Execution of `netsh firewall` commands to enable RDP.
- File activity in `C:\WINDOWS\sysvol\sysvol\[domain].local\scripts\`.
## Associated Threat Actors
- **Unknown:** Huntress identifies this as a "previously unseen" variant; no specific attribution to a named APT or e-crime group was provided in the initial report.
## Detection Methods
- **Signature-based detection:** Scanning for the hardcoded base64 strings related to the Obscura ransom note and the specific Go build paths identified in the binary.
- **Behavioral detection:**
- Monitoring for `vssadmin` activity coupled with high-frequency file modifications.
- Detection of unauthorized creation of scheduled tasks (e.g., `SystemUpdate`) pointing to `NETLOGON` shares.
- Monitoring for unexpected environment variable assignments (`DAEMON=1`).
## Mitigation Strategies
- **Least Privilege:** Restrict administrative access to domain controllers and limit the ability of service accounts to create scheduled tasks.
- **Hardening NETLOGON:** Audit and restrict write access to the `SYSVOL` and `NETLOGON` shares to authorized administrators only.
- **Endpoint Protection:** Deploy EDR/AV solutions capable of detecting shadow copy deletion and Go-based ransomware entropy.
- **Offline Backups:** Maintain immutable, off-site backups to counter the deletion of local shadow copies.
## Related Tools/Techniques
- **Lockbit/Akira:** Similar in their use of administrative tools and lateral movement, though Obscura is unique in its specific Go implementation and "Daemon" trigger mechanism.
- **Gootloader:** Sometimes used as an initial access vector for ransomware, though not confirmed in this specific Obscura case.