Full Report
Huntress analysts see a number of attacks on a daily and weekly basis, some of which include ransomware attacks. Now and again, Huntress analysts will observe a ransomware attack that stands out in some novel manner.
Analysis Summary
# Incident Report: ReadText34 Ransomware Incident
## Executive Summary
In September 2024, Huntress analysts identified a ransomware attack involving the deployment of the "ReadText34" variant. The threat actor leveraged a Bring Your Own Vulnerable Driver (BYOVD) technique using the TrueSight RogueKiller driver to disable on-disk security products. Despite limited visibility across the network, the attack was contained at the endpoint level shortly after encryption began.
## Incident Details
- **Discovery Date:** Second week of September 2024
- **Incident Date:** September 2024
- **Affected Organization:** Redacted
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** September 2024
- **Vector:** Internal Lateral Movement / Credential Use
- **Details:** The threat actor used compromised Administrator credentials to access the `C$` share from an internal IP address.
### Lateral Movement
- The attacker used **reg.exe** to remotely enable Remote Desktop Protocol (RDP) on the target system.
- After an initial failed login attempt (due to a typo: "adminitrator"), the actor successfully logged in via RDP from a workstation named **HOME-PC**.
### Data Exfiltration/Impact
- **Impact:** Files were encrypted on the compromised endpoint.
- **Ransomware:** ReadText34.
- **Note:** Data exfiltration was not explicitly confirmed in the provided report, but ransomware canaries were triggered.
### Detection & Response
- **Detection:** Huntress alerts were triggered by the enabling of RDP, commands to disable system recovery, and the modification of ransomware canaries.
- **Response:** Huntress analysts observed the crash of Trend Micro security products and the subsequent execution of the ransomware binary, allowing for containment and investigation.
## Attack Methodology
- **Initial Access:** Valid Accounts (Administrator).
- **Persistence:** Creation of a kernel service (**winppx**) intended to start at boot (though this failed).
- **Privilege Escalation:** Use of high-privilege Administrator credentials and kernel-level driver installation.
- **Defense Evasion:**
- **BYOVD (Bring Your Own Vulnerable Driver):** Leveraged `truesight.sys` (TrueSight RogueKiller Antirootkit Driver) to terminate security processes.
- **Impair Defenses:** Executed commands to disable driver signature enforcement (`bcdedit.exe /set loadoptions DDISABLE_INTEGRITY_CHECKS`).
- **Targeted Disruption:** Placed malicious files in `AppData\Roaming\trend micro\` to specifically target and crash Trend Micro security products.
- **Discovery:** System recovery disabling commands (e.g., `vssadmin delete shadows`).
- **Lateral Movement:** RDP (Remote Desktop Protocol) and SMB (C$ share).
- **Impact:** Data Encrypted for Impact (ReadText34 ransomware).
## Impact Assessment
- **Financial:** Unknown.
- **Data Breach:** File encryption confirmed on at least one endpoint.
- **Operational:** Disruption to the impacted endpoint; potential wider disruption mitigated by detection.
- **Reputational:** Not disclosed.
## Indicators of Compromise
- **Files:**
- `Trend.exe` (Driver installer)
- `truesight.sys` (Vulnerable anti-rootkit driver)
- `readtext34.exe` (Ransomware payload)
- `winppx.exe` (Malicious kernel driver loader)
- **Behavioral:**
- Execution of `bcdedit` to disable integrity checks.
- Remote registry modification to enable RDP (`HKLM\System\CurrentControlSet\Control\Terminal Server` fDenyTSConnections = 0).
- Sudden termination of security software services.
- Source Workstation Name: `HOME-PC`.
## Response Actions
- **Containment:** Detection of canary file modifications allowed for rapid identification of the infection.
- **Eradication:** Identification and collection of malicious binaries (`trend.exe`, `readtext34.exe`) for analysis.
- **Recovery:** Limited by the fact that the Huntress agent was not fully deployed across all endpoints at the time of the incident.
## Lessons Learned
- **Visibility Gaps:** The incomplete deployment of the EDR agent limited the ability to track the threat actor's movement prior to accessing the specific endpoint.
- **Credential Hygiene:** The use of the local Administrator account and SMB shares facilitated easy lateral movement.
- **BYOVD Awareness:** Attackers are increasingly using legitimate but vulnerable drivers to bypass and "kill" modern XDR/EDR solutions.
## Recommendations
- **Full EDR Coverage:** Ensure security agents are deployed to 100% of the environment to eliminate blind spots.
- **Disable RDP:** Block RDP (Port 3389) at the network level and disable it on endpoints unless strictly necessary.
- **Driver Blocklisting:** Implement Microsoft’s recommended driver blocklist to prevent the loading of known vulnerable drivers like `truesight.sys`.
- **Restrict Administrative Shares:** Limit access to administrative shares (C$, Admin$) and monitor for their use in lateral movement.
- **MFA Implementation:** Enforce Multi-Factor Authentication for all RDP sessions and administrative logins.