{"id":6464,"date":"2024-04-23T10:03:28","date_gmt":"2024-04-23T16:03:28","guid":{"rendered":"https:\/red-ransomware-group-a-new-threat-actor\/"},"modified":"2025-06-05T13:04:12","modified_gmt":"2025-06-05T19:04:12","slug":"red-ransomware-group-a-new-threat-actor","status":"publish","type":"post","link":"https:\/\/beaconlab.us\/en\/red-ransomware-group-a-new-threat-actor\/","title":{"rendered":"Red Ransomware Group, a new threat actor"},"content":{"rendered":"

Recently Beacon Lab has conducted an investigation of an incident, in which a new ransomware group, named Red Ransomware Group according to their public blog, or also Red CryptoApp (because of the encryption extension), has been discovered. Like most of today’s ransomware groups, they use a double extortion strategy: file encryption and data exfiltration and their respective publication in a public blog (“Hall of Shame”). In this article we will discuss the tactics, techniques and procedures (TTP) of this new group, as well as some characteristics of their operation. <\/p>\n

\"\"<\/p>\n

Operation of Red Ransomware Group:<\/strong><\/h3>\n

At the time of the investigation, the group’s public blog (“Hall of Shame”) listed only about ten victims. Apparently, the first victims were posted on the portal on March 5, 2024, with the group’s attacks beginning at the earliest in mid-February 2024. Like most ransomware groups, this group leaves a ransom note in txt format, with the name HOW_TO_RESTORE_FILES.REDCryptoApp.txt on all encrypted folders. The note contains a reference to the private negotiation portal, and a unique ID for each client. <\/p>\n

\"\"<\/p>\n

The negotiation portal consists of a chat with the group’s support team, as well as the payment details (wallet address and amount demanded, as well as some details of the attack). The exfiltrated data size data is most likely false. According to other analyzed notes, the wallet address is apparently the same for several victims. So far, no payments have been made to the wallet. <\/p>\n

\"\"<\/p>\n

\"\"
\nAn analysis of this group’s public blog suggests that this is a new group, which began operations recently. At the time of the blog analysis, 12 victims were listed, all with the same date. In the last few days, only one new victim has been added. Although the download links for the published files currently point to a different address than the public blog and are broken, at the time of analysis the links were functional and it was found that they did indeed allow the download of legitimate exfiltrated files from the victims. <\/p>\n

\"\"<\/p>\n

It is striking that, in some cases, the description of some victims does not actually correspond to the victim company, but to a description of another company with a similar name, demonstrating a certain carelessness when listing the company; it also demonstrates a semi-manual Google search process, prone to error.<\/p>\n

Chain of infection and techniques:<\/strong><\/h4>\n
\n

\"\"<\/p>\n

Initial attack vector:<\/strong><\/h4>\n

In the investigated incident, Red Ransomware Group was found to exploit vulnerability CVE-2023-47246<\/strong> in SysAid<\/strong> software that had been publicly reported in early November 2023. It is a Path Traversal vulnerability that leads to code execution affecting SysAid on-premise versions prior to 23.3.36. Through this vulnerability, the actor was able to upload webshells to the SysAid<\/strong> root directory and take control of the server. The webshells were found in the “managerap” path, inside the root directory of SysAid’<\/strong>s Tomcat server, trying to camouflage themselves with the manager folder that is part of the real structure of the application. Several webshells were found, among them, Jsp File Browser, which, among other things, allows exploring the file system, reading, creating and modifying files, executing commands, uploading artifacts, etc. This webshell is used by the group to upload, execute and install other remote control software (RMM) on the server. <\/p>\n

\"\"<\/p>\n

It cannot be ruled out that the group uses access previously acquired from other criminal groups that have previously compromised and gained access to servers, and that usually offer it in underground markets (“Access brokers”), since in the particular case investigated, there were already some webshells previously injected, all as a result of the exploitation of the mentioned SysAid<\/strong> vulnerability.<\/p>\n

Command and control:<\/h4>\n

It has been observed that the group uses the JWrapper tool to deploy SimpleHelp Remote Access<\/strong>, a remote control software intended to provide remote support, in a client-server, self-hosted model. The SimpleHelp client connects to a server under the attacker’s control. In this case, the attacker’s server was located at https:\/\/64.31.63.240\/access,<\/a> hosted by LimeStone Neworks (France). <\/p>\n

\"\"<\/p>\n

We also detected other remote control tools, which had been installed using the NSSM<\/strong>(Non-sucking Service Manager<\/strong>) tool, a legitimate tool for managing services on Windows operating systems. The executable of this program was located in C:windowssystem32, <\/strong>masked under the name HealthReport.exe.<\/strong> NSSM installed and executed AnyDesk<\/strong>, another popular remote control program, and a malicious DLL c:windowssystem32users.dll <\/strong>(Hash SHA256: e37b95bb9bee64cc0313eaad8a0269493745f89413bd78b58bb3b479b36084ae). This DLL is waiting for commands, which are sent to it from https:\/\/cl1p.net\/101012.<\/a> Cl1p.net is a free online tool that acts as an online clipboard where the attacker writes a command that is then read from the compromised server, thus being able to send commands to the server, evading security tools, which are not able to inspect the command that is sent. We also found that ScreenConnect was used, with a connection ID b5be755f21077092 It is not entirely clear if all of these tools are installed by Red Ransomware Group, or if some of them were provided by an Access Broker that had previously gained control over the compromised SysAid<\/strong> server. It was possible to verify the use of AnyDesk and ScreenConnect as a secondary C&C mechanism by this group. All command and control tools had been installed as system services and configured at startup to allow for greater persistence. <\/p>\n

Internal scanning:<\/h4>\n

The group uses SoftPerfect Network Scanner (netscan.exe) to scan other computers on the network. It is a portable scanner that allows you to discover hosts, scan ports, discover shared folders, and extract computer details via WMI, SNMP, HTTP, SSH and PowerShell. <\/p>\n

\"\"<\/p>\n

We also checked the use of Nmap and Advaced IP Scanner, but it is very likely that they were installed and made available by other Access Brokers.<\/p>\n

Lateral movement:<\/h4>\n

To move laterally to other computers on the network, the Red Ransomware Group mostly uses Pass the Hash. To dump hashes the group uses the Procdump<\/strong> tool, a command line tool developed by Microsoft, part of SysInternals, which is used to create dumps of processes on Windows systems. In this case, the actor obtains the hashes from the dump of the lsass.exe process. <\/p>\n

C:Programdatap64.exe -accepteula -ma lsass.exe C:Programdatao.dmp<\/pre>\n
The dump allows him to obtain the domain administrator hashes, which will then be used to connect to various machines to deploy artifacts, including the encrypter. Using the SMBExec tool, the attacker enables Restricted Admin Mode<\/strong>, which allows him to perform Pass-the-Hash lateral movements via RDP: Obfuscated command:<\/p>\n
%COMSPEC% \/Q \/c echo powershell -exec bypass -enc TgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwB5AHMAdABlAG0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwATABzAGEAIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBSAGUAcwB0AHIAaQBjAHQAZQBkAEEAZABtAGkAbgAiACAALQBWAGEAbAB1AGUAIAAiADAAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQA= ^> \\127.0.0.1C$__output 2^>^&1 > %TEMP%execute.bat & %COMSPEC% \/Q \/c %TEMP%execute.bat & del %TEMP%execute.bat<\/pre>\n
Deofuscated command:<\/p>\n
%COMSPEC% \/Q \/c echo powershell -exec bypass -enc New-ItemProperty -Path \"HKLM:SystemCurrentControlSetControlLsa\" -Name \"DisableRestrictedAdmin\" -Value \"0\" -PropertyType DWORD -Force > \\127.0.0.1C$__output 2^>^&1 > %TEMP%execute.bat & %COMSPEC% \/Q \/c %TEMP%execute.bat & del %TEMP%execute.bat\n<\/pre>\n
\"\"<\/p>\n
Exfiltration:<\/h4>\n
Red Ransomware Group uses the well-known Rclone<\/strong> tool, a command-line tool for synchronizing files and directories from a computer with the most popular cloud content hosting providers. The actor sends the exfiltrated data to Put.io, a well-known cloud hosting service that has been used by other groups in the past. In the case under investigation, the exfiltration took place only on one of the affected servers.  <\/p>\n
 <\/strong><\/p>\n
Persistence:<\/h4>\n
To ensure persistence, the actor creates several users, both local and workgroup, which were added to the local administrator groups of the affected computers, using native Windows commands (quser and net):<\/p>\n
\"\"
\n\"\"<\/p>\n
Evasion:<\/h4>\n
We have observed that the group uses the well-known anti-rootkit tools GMER<\/strong> and AVAST aswArPot,<\/strong> masked under the name un63td1n.exe and aswQP_Avar.sys respectively. To interrupt the processes corresponding to the Antivirus \/ EDR, thus evading any protection or blocking that these may cause. <\/p>\n
\"\"<\/p>\n
Impact:<\/h4>\n
To deploy the ransomware, the attacker uses PDQ Deploy<\/strong>, a tool used for mass deployment of scripts to multiple devices.<\/p>\n
\"\"<\/p>\n
With this tool, the attacker builds an XML that is deployed and executes various actions on all the servers to which he has previously gained access, among them:<\/p>\n
    \n
  1. Eliminate the records of the most known EDRs, preventing their initiation.<\/li>\n
  2. Ensuring autostart of AnyDesk and Screenconnect<\/li>\n
  3. Creation of an ekrnEpfwFF <\/strong>service that ensures the start of AAA.ps1, previously created, with the restart of the operating system:\n
      \n
    1. The script AAA.ps1, which is obfuscated, copies the binary corresponding to the encrypter in the path C:programdata, with the name exe<\/strong>, creates and executes some powershell scripts (S01.ps1 and S02.ps2) in charge of the encrypter execution and then deletes some traces, including these scripts.<\/li>\n<\/ol>\n<\/li>\n
    2. Creation of user Administrator2 (<\/strong>password P@ssw0rd1234!), in Autologon mode<\/li>\n
    3. SMB connection to target server to be encrypted, with Workgroup test<\/strong> user (P@ssw0rd123)<\/li>\n
    4. Copy AAA.ps1 script to C:programdata of each computer to be encrypted.<\/li>\n<\/ol>\n
      The encrypter is copied with the name AAQQ.exe. The executable is packaged with UPX and is written in Go. Its hash (SHA-256) is: ba84c8200820016298ad5e15a5f3eb9ab608491963ff333ae0e1267ac48ac909606e  <\/p>\n
      Other interesting facts:<\/strong><\/p>\n
      To execute some of the post-exploitation actions after connecting via SimpleHelp, the group uses Win-PTY (winpty-agent.exe, https:\/\/github.com\/rprichard\/winpty)<\/a>, a tool that provides a Unix-like pseudo-terminal interface to communicate with Windows console programs and send CMD commands in a more convenient way. Powershell Script Obfuscation: All Powershell scripts of this attacker are obfuscated with a simple character replacement algorithm.<\/p>\n
      \"\"<\/p>\n
       <\/p>\n
      Script S01.ps1: Although, the attacker deletes said file, it was possible to obtain it from the AAA.ps1 script that generates it. It is the script in charge of deleting backup copies and removing traces, mainly. It consists of 7 sections, which execute a series of actions, such as:<\/p>\n