DUNGEON SPIDER

Also known as: DUNGEON SPIDER, Dungeon Spider

DUNGEON SPIDER is a criminal group operating the ransomware most commonly known as Locky, which has been active since February 2016 and was last observed in late 2017. Locky is a ransomware tool that encrypts files using a combination of cryptographic algorithms: RSA with a key size of 2,048 bits, and AES with a key size of 128 bits. Locky targets a large number of file extensions and is able to encrypt data on shared network drives. In an attempt to further impact victims and prevent file recovery, Locky deletes all of the Shadow Volume Copies on the machine. DUNGEON SPIDER primarily relies on broad spam campaigns with malicious attachments for distribution. Locky is the community/industry name associated with this actor.

🌍 Country ["Russia"]

Associated Operations

2016-02 2016-04 2016-06 2016-08 2017-01 2017-04 2017-08 2017-09 2017-11 2018-02 A cyberattack launched against the Hollywood Presbyterian Medical Center has forced staff to declare an “internal emergency” and left employees unable to access patient files. A red marquee bannered on the homepage of the Methodist Hospital in Henderson Japanese Trends in the Aggressive Activity of the “Locky” Ransomware Kentucky announced a cyberattack that successfully penetrated their networks Locky Ransomware Distributed Via DOCM Attachments in Latest Email Campaigns Locky Ransomware Hides Under Multiple Obfuscated Layers of JavaScript Locky Ransomware Is Back in a Big Way Locky Ransomware switches to the Lukitus extension for Encrypted Files Locky Struggles Locky ransomware strikes at Amazon New Locky Ransomware Phishing Attacks Beat Machine Learning Tools Now The most recent change for Locky came as one of the most popular ways to spread malware: spear phishing emails. Without Necurs cybercriminals are using PDFs instead of Word documents to deliver Locky ransomware. https://blog.talosintelligence.com/2017/01/locky-struggles.html https://shadownet.co.za/2019/07/01/locky-ransomware-is-back-in-a-big-way/ https://threatvector.cylance.com/en_us/home/threat-spotlight-locky-ransomware.html https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-the-lukitus-extension-for-encrypted-files/ https://www.darkreading.com/attacks-breaches/new-locky-ransomware-phishing-attacks-beat-machine-learning-tools/d/d-id/1330010 https://www.fireeye.com/blog/threat-research/2016/08/locky_ransomwaredis.html https://www.fortinet.com/blog/threat-research/japanese-trends-in-the-aggressive-activity-of-the-locky-ransomware.html https://www.mcafee.com/blogs/other-blogs/mcafee-labs/locky-ransomware-hides-under-multiple-obfuscated-layers-of-javascript/ https://www.pandasecurity.com/mediacenter/malware/locky-ransomware-strikes-amazon/ https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/locky-ransomware-strain-led-kentucky-hospital-to-an-internal-state-of-emergency https://www.vadesecure.com/en/locky-malware-comeback/ https://www.zdnet.com/article/hollywood-hospital-becomes-ransomware-victim/ prompting it to operate under an “internal state of emergency”.

Introduction

DUNGEON SPIDER is a criminal group operating the ransomware most commonly known as Locky, which has been active since February 2016 and was last observed in late 2017. Locky is a ransomware tool that encrypts files using a combination of cryptographic algorithms: RSA with a key size of 2,048 bits, and AES with a key size of 128 bits. Locky targets a large number of file extensions and is able to encrypt data on shared network drives. In an attempt to further impact victims and prevent file recovery, Locky deletes all of the Shadow Volume Copies on the machine. DUNGEON SPIDER primarily relies on broad spam campaigns with malicious attachments for distribution. Locky is the community/industry name associated with this actor.

Activities and Tactics

Country of Origin: 🇷🇺 [“Russia”]

Notable Campaigns

  • 2016-02
  • 2016-04
  • 2016-06
  • 2016-08
  • 2017-01
  • 2017-04
  • 2017-08
  • 2017-09
  • 2017-11
  • 2018-02
  • A cyberattack launched against the Hollywood Presbyterian Medical Center has forced staff to declare an “internal emergency” and left employees unable to access patient files.
  • A red marquee bannered on the homepage of the Methodist Hospital in Henderson
  • Japanese Trends in the Aggressive Activity of the “Locky” Ransomware
  • Kentucky announced a cyberattack that successfully penetrated their networks
  • Locky Ransomware Distributed Via DOCM Attachments in Latest Email Campaigns
  • Locky Ransomware Hides Under Multiple Obfuscated Layers of JavaScript
  • Locky Ransomware Is Back in a Big Way
  • Locky Ransomware switches to the Lukitus extension for Encrypted Files
  • Locky Struggles
  • Locky ransomware strikes at Amazon
  • New Locky Ransomware Phishing Attacks Beat Machine Learning Tools
  • Now
  • The most recent change for Locky came as one of the most popular ways to spread malware: spear phishing emails.
  • Without Necurs
  • cybercriminals are using PDFs instead of Word documents to deliver Locky ransomware.
  • https://blog.talosintelligence.com/2017/01/locky-struggles.html
  • https://shadownet.co.za/2019/07/01/locky-ransomware-is-back-in-a-big-way/
  • https://threatvector.cylance.com/en_us/home/threat-spotlight-locky-ransomware.html
  • https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-the-lukitus-extension-for-encrypted-files/
  • https://www.darkreading.com/attacks-breaches/new-locky-ransomware-phishing-attacks-beat-machine-learning-tools/d/d-id/1330010
  • https://www.fireeye.com/blog/threat-research/2016/08/locky_ransomwaredis.html
  • https://www.fortinet.com/blog/threat-research/japanese-trends-in-the-aggressive-activity-of-the-locky-ransomware.html
  • https://www.mcafee.com/blogs/other-blogs/mcafee-labs/locky-ransomware-hides-under-multiple-obfuscated-layers-of-javascript/
  • https://www.pandasecurity.com/mediacenter/malware/locky-ransomware-strikes-amazon/
  • https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/locky-ransomware-strain-led-kentucky-hospital-to-an-internal-state-of-emergency
  • https://www.vadesecure.com/en/locky-malware-comeback/
  • https://www.zdnet.com/article/hollywood-hospital-becomes-ransomware-victim/
  • prompting it to operate under an “internal state of emergency”.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • GraphicBooting
  • Revenge-RAT
  • Locky:

Attribution and Evidence

Country of Origin: [“Russia”] Additional attribution information pending cataloguing.

References

References pending cataloguing.