A zero-day bug in SonicWall SMA 100 Series VPN appliances was exploited by a hacker to deploy new ransomware known as FiveHands on the networks of North American and European targets.
The group, tracked by Mandiant threat analysts as UNC2447, exploited the CVE-2021-20016 SonicWall vulnerability to breach networks and deploy FiveHands ransomware payloads before patches were released in late February 2021.
Prior to deploying the ransomware payloads, UNC2447 was also found to be using Cobalt Strike implants for gaining persistence and installing a SombRAT backdoor variant, a malware first spotted in the CostaRicto campaign coordinated by a group of mercenary hackers.
The FiveHands ransomware deployed in UNC2447 attacks was first observed in the wild last October. It is very similar to HelloKitty ransomware, both of which are rewrites of DeathRansom ransomware.
HelloKitty ransomware has targeted several large companies but their activity had slowly reduced starting with January 2021 when FiveHands began to pick up.
The researchers state that based on technical and temporal observations of HELLOKITTY and FIVEHANDS deployments, it is believed that HELLOKITTY may have been used by an overall affiliate program from May 2020 through December 2020, and FIVEHANDS since January 2021.
Besides their sharing feature, functionality, and coding similarities, the two malware strains were also linked by Mandiant after observing a FiveHands ransomware Tor chat using a HelloKitty favicon.
FiveHands also has extra functionality that it can use the Windows Restart Manager to close a file currently in use so that it can be unlocked and successfully encrypted.
It further differs by using different embedded encryption libraries, a memory-only dropper, and asynchronous I/O requests, which is not found in the two other ransomware strains.
Mandiant reported that UNC2447 monetizes intrusions by extorting their victims first with FIVEHANDS ransomware followed by pressurizing them through threats of media attention and offering victim data for sale on hacker forums.
UNC2447 has been observed targeting organizations in Europe and North America and has consistently displayed advanced capabilities to evade detection and minimize post-intrusion forensics.
In March, Mandiant analysts discovered three more zero-day vulnerabilities in SonicWall’s on-premises and hosted Email Security (ES) products which are also being actively exploited by another group tracked as UNC2682 to backdoor systems using BEHINDER web shells to move laterally through the victims’ networks and gain access to emails and files.
