{"id":547,"date":"2023-12-07T19:24:42","date_gmt":"2023-12-07T19:24:42","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=547"},"modified":"2023-12-07T19:24:42","modified_gmt":"2023-12-07T19:24:42","slug":"threat-profile-ransomhouse","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2023\/12\/07\/threat-profile-ransomhouse\/","title":{"rendered":"Threat Profile: Ransomhouse"},"content":{"rendered":"

\"\"<\/p>\n

 <\/p>\n

Objective<\/h1>\n

The objective of this document is to present available information about the RansomHouse<\/em> threat actor. To that purpose, the data and the Indicators of Compromise within were gathered by SCILabs through intelligence processes in open sources, monitoring tasks, and dedicated threat hunting in the region during the first and second weeks of November 2023. Furthermore, detailed descriptions of the TTP, and tools used by this cybercriminal group are provided.<\/p>\n

 <\/p>\n

General overview<\/h1>\n

The RansomHouse<\/em> threat actor has been active since December 2021<\/a>, and has become relevant for having carried out attacks on large companies such as AMD<\/a>, ADATA<\/a> , and IFX Networks<\/a>: the latter is known for having had the major impact in LATAM.<\/p>\n

 <\/p>\n

According to their leak site and their Telegram channel, the members of RansomHouse<\/em> are dedicated to find security flaws in computer systems; however, instead of reporting them as ethical hackers would do, they take the opportunity to extract the information and then request ransom payment, which according to public<\/a> investigations can reach amounts close to 4.5 million euros.<\/p>\n

 <\/p>\n

The victims of this threat actor have not revealed many details because, according to their posts<\/a>, most intrusions are personalized attacks. However, according to the information analyzed by SCILabs, some of the vulnerabilities that the group exploits are in Google Chrome (CVE-2023-4863<\/strong><\/a> ), MacOS (CVE-2023-41064<\/strong><\/a> and CVE-2023-41061<\/strong><\/a>) and ESXi (CVE-2023-20867<\/strong><\/a> ).
\nRansomHouse<\/em> only encrypts the information if the ransom <\/a>demands are not met. It was possible to identify that they use variants of the Babuk<\/em> <\/a>ransomware that mainly seek to encrypt virtual machines on Linux (ESX). Also, it is worth mentioning that the code of that ransomware was leaked in 2021 (also the year RansomHouse<\/em> emerged) on a Russian<\/a> forum.<\/p>\n

 <\/p>\n

Some of the Babuk ransomware<\/em> variants observed in attacks by RansomHouse<\/em> are WhiteRabbit<\/em> <\/a>and MarioLocker<\/em><\/a>, both considered Ransomware-As-a-Service (RaaS<\/a>).<\/p>\n

 <\/p>\n

With a high confidence level, according to SCILabs\u2019 hypothesis, the threat actor engages in opportunistic attacks, indicating a lack of preference for a specific sector or location. This approach allows them to achieve broader reach and maximize their chances of success.<\/p>\n

 <\/p>\n

Region of operations<\/h1>\n

As a result of the OSINT processes and the analysis of the artifacts, SCILabs determined, with a high level of confidence, that the RansomHouse\u00b4s victims are from Germany, Australia, Belgium, Canada, China, Colombia, United Arab Emirates, Spain, United States, Philippines, India, Indonesia, Italy, Maldives, United Kingdom, San Cristobal y Nieves, Singapore, South Africa, Sweden, Taiwan and Vanuatu, and it has international presence<\/p>\n

 <\/p>\n

The following map shows in red the countries that have had most of the security incidents (18) related to RansomHouse<\/em>, in orange those that have been moderately affected (between 7 and 8 attacks) and finally, in yellow, the locations that have only been victims 1 or 2 times by this threat actor.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Figure 1. RansomHouse<\/em> confirmed attacks by region<\/strong><\/span><\/p>\n

 <\/p>\n

In Latin America the most affected country by this group was Colombia (with two confirmed attacks), and internationally, the United States is the nation that has suffered the most ransomware attacks orchestrated by RansomHouse<\/em>, with a total of 18, followed by Italy with 8 attacks and the United Kingdom with 7 attacks.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Figure 2. RansomHouse <\/em>confirmed attacks by country<\/strong><\/span><\/p>\n

 <\/p>\n

Below is a timeline with the most relevant activity (large-scale events or events with great media impact) of RansomHouse<\/em> based on SCILabs telemetry, along with various posts from the attackers’ leak blog, since its appearance in December 2021 to September 2023.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Figure 3. Most relevant attacks by RansomHouse<\/em><\/strong><\/span><\/p>\n

 <\/p>\n

It is essential to mention that, although the attacks shown above are the most relevant, they are not the only ones perpetrated by RansomHouse<\/em>. According to SCILabs telemetry, there are currently at least 55 organizations, public and private that have been victims. This threat actor has had its most productive period in 2023 (31 attacks in 2023, 22 attacks in 2022, and 2 attacks in 2021) since its inception in 2021.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Figure 4. Trend attacks of RansomHouse<\/em><\/strong><\/span><\/p>\n

 <\/p>\n

Who can it affect?<\/h1>\n

During constant monitoring of the region, SCILabs identified that RansomHouse<\/em> attacks are directed at organizations of all types in different industries such as: health, retail, education, services, construction, transportation, and technology. Telemetry indicates that the most affected sector by this ransomware is health, followed by services and technology.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Figure 5. RansomHouse<\/em> attacks by affected sector<\/strong><\/span><\/p>\n

 <\/p>\n

How can it affect an organization?<\/h1>\n

If a RansomHouse<\/em> attack is successful, the threat actor could steal, leak, and encrypt information of all types from victim organizations, disrupting operations that cause financial loss, compromise of sensitive data, as well as loss of reputation and trust in the organization. Therefore, organizations must be aware of this threat actor\u2019s TTP (Tactics, Techniques, and Procedures) to minimize the probability of being infected and know how to act if RansomHouse<\/em> compromises them.<\/p>\n

 <\/p>\n

Analysis<\/h1>\n

 <\/p>\n

Threat context<\/h2>\n

Despite not being a new threat actor (active since 2021), as of this document’s creation date, no research has yet been made public that describes the full range of behavioral and tools that RansomHouse<\/em> uses during its infection chain. However, SCILabs analyzed all the information available about this threat actor campaigns, artifacts, and TTP, resulting in the following summary:<\/p>\n

 <\/p>\n