Full Report
Deep Dive into Prolific RaaS Affiliates' TTPs
Analysis Summary
# Tool/Technique: REvil (Sodinokibi) Affiliate TTPs
## Overview
This entry summarizes the Tactics, Techniques, and Procedures (TTPs) employed by affiliates of the REvil (Sodinokibi) Ransomware-as-a-Service (RaaS) operation. These affiliates engage in "Big Game Hunting," targeting large organizations for high-value ransoms through a combination of sophisticated network penetration, data exfiltration, and final encryption.
## Technical Details
- **Type**: Ransomware family / Affiliate TTPs
- **Platform**: Windows (Primary focus)
- **Capabilities**: Credential theft, lateral movement, data exfiltration, security software disabling, and backup destruction.
- **First Seen**: REvil first emerged in April 2019.
## MITRE ATT&CK Mapping
- **TA0008 - Lateral Movement**
- T1021.001 - Remote Desktop Protocol
- T1570 - Lateral Tool Transfer
- **TA0009 - Collection**
- T1005 - Data from Local System
- **TA0010 - Exfiltration**
- T1567.002 - Exfiltration to Cloud Storage
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact
- T1490 - Inhibit System Recovery
## Functionality
### Core Capabilities
- **Lateral Movement:** Extensive use of RDP for moving between hosts. Affiliates often modify RDP settings via PowerShell to allow connections and bypass authentication requirements.
- **Data Exfiltration:** Affiliates utilize legitimate tools like **WinSCP** (using SMB/SFTP) and cloud sync clients like **MEGASync** to move data to adversary-controlled servers or cloud storage.
- **Backup Destruction:** Actively identifying and wiping backups or prioritizing ransomware execution on backup servers to prevent recovery.
### Advanced Features
- **Security Evasion:** Disabling endpoint security products or modifying their configurations to add the ransomware executable to exclusion lists before deployment.
- **Mass Deployment:** Utilizing **PsExec** or **Group Policy Objects (GPOs)** to create scheduled tasks that execute the ransomware across the entire network simultaneously.
## Indicators of Compromise
- **File Names:** `WinSCP.exe`, `MEGASync.exe`, `PsExec.exe`.
- **Registry Keys:** `HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp` (Value: `UserAuthentication`).
- **Network Indicators:**
- Connections to `mega[.]nz` or `mega[.]io` from unauthorized servers.
- Unusual SFTP/FTP traffic to external IPs.
- **Behavioral Indicators:**
- Execution of PowerShell commands to modify `Win32_TSGeneralSetting`.
- Deployment of `PsExec` from a Domain Controller or administrative workstation.
- Creation of unexpected Scheduled Tasks via GPO.
## Associated Threat Actors
- **REvil (Sodinokibi) Affiliates**
- Linked to actors previously associated with **GandCrab**.
## Detection Methods
- **Behavioral Detection:** Monitor for the use of `Set-WmiObject` to modify Terminal Services settings and `Enable-NetFirewallRule` for RDP.
- **Anomaly Detection:** Audit the installation of dual-use tools like WinSCP or cloud storage clients on servers where they lack a business justification.
- **Traffic Analysis:** Monitor for large data transfers to known cloud storage providers from database or file servers.
## Mitigation Strategies
- **RDP Hardening:** Enforce Network Level Authentication (NLA) and restrict RDP access to specific management IPs via a VPN or Gateway.
- **Privileged Access Management:** Restrict the use of administrative tools like PsExec to authorized personnel and monitor their usage.
- **Egress Filtering:** Implement strict firewall rules to prevent unauthorized data exfiltration to cloud storage and FTP sites.
- **Immutable Backups:** Maintain offline or immutable backups that cannot be modified or deleted by a compromised administrative account.
## Related Tools/Techniques
- **GandCrab:** Predecessor to REvil.
- **PsExec:** Used for lateral movement and remote execution.
- **WinSCP / MEGASync:** Used for "Double Extortion" data theft.