Full Report
“Double extortion” attacks, often perpetrated by ransomware threat actors, include data exfiltration prior to file encryption. Huntress analysts have observed various means of data exfiltration, but recently observed the use of a legitimate backup application seen by others to be associated with a Noberus/ALPHV ransomware affiliate.
Analysis Summary
# Tool/Technique: Restic (Abused Legitimate Backup Utility)
## Overview
Restic is a modern, fast, and secure open-source backup program. While designed for legitimate data preservation, it is being increasingly co-opted by ransomware affiliates (specifically Noberus/ALPHV) for the purpose of "Double Extortion." In this context, the tool is used to exfiltrate sensitive data to attacker-controlled cloud storage before the final encryption phase of an attack.
## Technical Details
- **Type:** Legitimate Tool (Abused for Data Exfiltration)
- **Platform:** Windows (Observed), Linux, macOS, BSD
- **Capabilities:** Incremental backups, encryption, cross-platform support, and native integration with cloud storage backends (S3, Wasabi, Backblaze).
- **First Seen:** Reported by Huntress in March 2024 (specifically used by ALPHV affiliates).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1078 - Valid Accounts]
- **[TA0003 - Persistence] / [TA0005 - Defense Evasion]**
- [T1133 - External Remote Services (RDP)]
- [T1036.005 - Masquerading: Match Legitimate Name or Location]
- **[TA0007 - Discovery]**
- [T1046 - Network Service Scanning]
- **[TA0010 - Exfiltration]**
- [T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage]
## Functionality
### Core Capabilities
- **Direct Cloud Integration:** Native ability to push data directly to S3-compatible buckets (Wasabi, Backblaze B2, AWS).
- **Snapshot-Based Exfiltration:** Efficiently packages directories into snapshots for rapid upload.
- **Environment Variable Support:** Can be configured using environment variables (`AWS_ACCESS_KEY_ID`, `RESTIC_PASSWORD`) to avoid passing credentials directly in the command line history.
### Advanced Features
- **Encryption:** Automatically encrypts data at rest, which can help threat actors bypass network DLP (Data Loss Prevention) sensors that look for plaintext sensitive data.
- **Deduplication:** Reduces the amount of data transferred, speeding up the exfiltration process.
## Indicators of Compromise
- **File Names:**
- `restic.exe`
- `dns.exe` (Observed masquerading)
- `system.exe` (Associated scanner tool, likely SoftPerfect Network Scanner)
- **Network Indicators (Defanged):**
- `s3.us-central-1.wasabisys[.]com`
- `s3.us-east-005.backblazeb2[.]com`
- `s3.us-west-002.backblazeb2[.]com`
- **Behavioral Indicators:**
- Modification of `HKLM\system\CurrentControlSet\Control\Terminal Server\fDenyTSConnections` to `0`.
- Setting specific environment variables: `RESTIC_PASSWORD`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`.
- Execution of backup commands targeting local drives (e.g., `C:\`) pointing to external S3 repositories.
## Associated Threat Actors
- **Noberus / ALPHV (BlackCat)** affiliates
- **INC Ransomware** (previously seen using similar tools like MegaSync)
## Detection Methods
- **Behavioral Detection:** Monitor for common backup utilities (restic, rclone, megasync) communicating with known cloud storage providers if those tools are not part of the standard IT toolkit.
- **Command Line Monitoring:** Alert on the use of `-r s3:` or `-r b2:` flags in command lines involving unknown or renamed binaries.
- **Registry Monitoring:** Monitor for unauthorized changes to Terminal Server settings (RDP enablement).
- **Process Auditing:** Look for binaries with missing "Original Filename" metadata or binaries renamed to look like system services (e.g., `dns.exe`) executing from `C:\Windows\` or `Downloads`.
## Mitigation Strategies
- **Least Privilege:** Restrict the ability of standard users to set system-wide environment variables or modify registry keys.
- **Application Whitelisting:** Prevent the execution of unauthorized backup utilities.
- **Network Filtering:** Block or monitor outbound traffic to common cloud storage APIs (Wasabi, Backblaze, Mega.nz) unless required for business operations.
- **RDP Hardening:** Ensure RDP is only accessible via VPN and protected by Multi-Factor Authentication (MFA).
## Related Tools/Techniques
- **Rclone:** Frequently used for similar cloud-based exfiltration.
- **MegaSync:** Another legitimate tool abused by INC Ransomware.
- **SoftPerfect Network Scanner:** Used for internal reconnaissance prior to exfiltration.