Dharma ransomware is considered to be “one of the most profitable ransomware families” because of its mass-market, service-based business model, which makes it attractive to cybercriminals, according to the latest report of Sophos titled “Color by Numbers: Inside a Dharma Ransomware-as-a-Service (RaaS) Attack.”
The security software company looked into Dharm’s automated attack script and toolset created by the ransomware operators and provided to cybercriminal buyers together with back-end infrastructure and malicious tools. It found out that various iterations of its source code have been dumped online or offered for sale, so many variants of the code now exist.
“Dharma is fast-food franchise ransomware: widely and easily available to just about anyone,” said Sean Gallagher, senior threat researcher at Sophos.
Sophos updates endpoint detection, response solution to quickly identify, respond to threats
Sophos discovers Emotet malware back in action after brief hiatus
Known since 2016, Dharma has been targeting small and mid-sized businesses (SMBs) with 85% of the attacks seen in 2020, based on the published report.
Data from Coverware, a ransomware recovery company, reveal that attackers exploit exposed access tools like Remote Desktop Protocol (RDP).
PowerShell
Cybercriminals rely almost entirely on a menu-driven PowerShell script that installs and launches the components required to spread ransomware across the target’s network. When the master script is executed, it identifies itself as “Toolbox” and launches the attack with the message, “Have fun, bro!”
“Dharma’s ransomware-as-a-service offerings expand the range of people who can execute devastating ransomware attacks,” Gallagher said.
Hackers know the weaknesses of open-source tools and freeware versions of commercial tools where they launch their attacks. Sophos said: “Decryption is a surprisingly complex two-stage process. Targets that contact affiliates for recovery keys are given a first-stage tool that extracts details of all of their encrypted files. Affiliates then share this extracted data is with their operators, who provide a second-stage decryption key for the files. How effective this process is in actually restoring data for the targets depends greatly on the skills and mood of the affiliates, according to the research.
“With so many multi-million dollar ransom demands, high profile targets and advanced adversaries like WastedLocker now making the headlines, it can be easy to forget that threats like Dharma are alive and well, and enabling a whole other rung of cybercriminals to hit multiple smaller targets to rake in a fortune, eight thousand dollars at a time,” said Gallagher.
Advice for defenders
- Shut down internet-facing remote desktop protocol (RDP) to deny cybercriminals access to networks. If you need access to RDP, put it behind a VPN connection
- Check that you have a full inventory of all devices connected to your network and always install the latest security updates, as soon as they are released, on all the devices and servers on your network
- Keep regular backups of your most important and current data on an offline storage device
- Be aware of the five early indicators an attacker is present to stop ransomware attacks
- Remember, there is no single silver bullet for security, and a layered, defense-in-depth security model is essential.