FBI Warns of Ransomware Gang who has been Attacking U.S. Companies since 2020

The FBI has issued a warning about a ransomware gang called the OnePercent Group.  The gang has been attacking companies in the United States since November 2020 by emailing targeted individuals inside an organization using social engineering tricks to try and dupe the unsuspecting employee into opening a malicious Word document within a zip file attached to the email.

From there, Macros embedded in the word document install a banking Trojan known as IcedID onto the victim’s computer.  The Trojan can steal login credentials for financial institutions as users attempt to access their online accounts. It can also download and drop other malware as well. 

Additionally, IcedID can download a piece of software called Cobalt Strike, which is a penetration testing tool hackers love because of the way it can assist in compromising organizations. Cobalt Strike moves laterally through a targeted organization, creating the opportunity for remote hackers to exfiltrate sensitive data and leave it encrypted on the victim’s machine. 

According to the FBI, criminals have been monitored within victims’ networks for “approximately one month prior to the deployment of the ransomware”.  In this time, attackers can learn a lot about your organization, and may have gained access to highly sensitive data.

Once this sensitive data is accessed, the OnePercent Group leaves a ransom note for its victim.  The note explains that the data has been encrypted and stolen, and that the affected company must respond within the week to retrieve their data.  If the victim does not respond in the allotted time, the group will email or call applying additional pressure for the victim to pay the ransom.

If a payment is not made quickly, the OnePercent Group threatens to release a small portion (1%) of the victim’s information on the dark web.  If the organization still continues to refuse to pay the ransom, the group threatens to sell the rest of the compromised data to the REvil cybercrime group to be auctioned off to the highest bidder.

So what can your organization do to protect yourself from an attack?  Your organization can:

• Configure an anti-virus product able to detect tools known to be used by OnePercent Group

• Back up critical data offline

• Ensure administrators are not using “Admin Approval” mode

• Implement Microsoft LAPS, if possible

• Ensure copies of critical data are in the cloud or on an external hard drive or storage device. This information should not be accessible from the compromised network

• Secure your back-ups and ensure data is not accessible for modification or deletion from the system where the original data resides

• Keep computers, devices and applications patched and up to date

• Consider adding an email banner to emails received from outside of your organization

• Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs

• Audit user accounts with administrative privileges and configure access controls with lease privilege in mind

• Implement network segmentation

• Use multi-factor authentication with strong passphrases

Story via Tripwire