Fake COVID-19 survey hides ransomware in Canadian university attack
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP! You will also find
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero.
In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 survey.
However, this attack and motives are different than the ones previously documented. The survey is a malicious Word document whose purpose is to download ransomware and extort victims to recover their encrypted files.
On discovery, we got in touch with UBC to report our findings. They were already aware of this phishing campaign and were kind enough to share more information with us about the incident. Ultimately, this attack was not successful due to the rapid response of the UBC cybersecurity team.
Mandatory COVID-19 survey distributed to targeted recipients
The attacker created an email address with the mailpoof.com service in order to register accounts with Box.net and DropBox. Rather than directly sending the fake survey via email, the attacker uploaded the document onto Box and DropBox and used the share functionality from these platforms to distribute it.
This was probably done to evade spam and phishing filters that would have blocked messages coming from a newly registered email address with a low reputation. In comparison, it is much more difficult to detect spam from file sharing services without creating a number of false positives.
The attacker claimed to be a manager and added the following comment in the file sharing invitation (shared with us by UBC):
Good evening gals and guys! [redacted] here, [redacted] manager for [redacted]. I am sharing a mandatory survey with you that must be completed by Monday. It asks a few questions about how you believe our company responded to the pandemic regarding remote working and much more. Please fill it out ASAP!
You will also find a form at the end that you can fill out if you need any necessities! Necessities include: gloves, hand sanitizer, masks, or disinfectant spray. We will be providing it to those employees who fill out the form for free! Simply sign your initials and put what you need as well as the quantity! In advance, we appreciate your feedback! Thanks all! Stay strong! I understand times like this can be difficult!
According to UBC, less than a hundred people within a specific department received the link to access the shared document. A Box or Dropbox account was required in order to download the file since it was shared privately, instead of publicly. This may have been an effort to evade detection or perhaps the attacker expected the target organization to already be using one of these two sharing services.
Phishing document analysis
The phishing document uses template injection to download and execute a remote template (template.dotm) weaponized with a malicious macro. That file was uploaded to a free code hosting website (notabug.org).
When the macro is executed, it does the following:
Gets the %APPDATA% directory
Creates the Byxor directory in %APPDATA%
Downloads a file from the following url and writes it as Polisen.exe
Checks the output of shell function and whether it was successful (return value would be task Id of executed application)
If successful, it sends a GET http request to: canarytokens.com/about/d4yeyvldfg6bn5y29by4e9fs3/post.jsp
If it isn’t successful, it sends a GET http request to: canarytokens.com/articles/6dbbnd503z06qitej1sdzzcvv/index.html
We were able to identify four other variants of the remote templates and payloads. In some of the folders, we found several artifacts using Swedish words, which could indicate that the threat actor is familiar with the language.
Opening the phishing document will trigger a notification via the canarytokens.com website. Typically, people use this type of service to get alerted for a particular event.
This can be very useful as an early warning notification system that an intruder has had access to a network. In this case, the attacker is probably interested in how many people opened the document and perhaps where they are from.
Vaggen ransomware
After being deployed, the ransomware starts encrypting the user’s files and adding the .VAGGEN extension to them. When the encryption process is finished, it drops a ransom note on the Desktop, demanding a payment equivalent to 80 USD to be paid in Bitcoin.
The ransomware appears to be coded from scratch and is a relatively straightforward application written in Go which starts with the function denoted as ‘main_main’.
Other functions belonging to the main application have obfuscated names, such as: main_FOLOJVAG, main_DUVETVAD, main_ELDBJORT, main_HIDDENBERRIES, main_LAMNARDETTA, main_SPRINGA.
A full list of the functions, along with their RVAs can be found here.
Some of the strings used by the malware (i.e. the content of the ransom note) are encrypted with the help of XXTEA (using library: xxtea-go). Encrypted chunks are first decoded from Base64. The XXTEA key is hardcoded (“STALKER”). At the end of the execution, the ransom note is dropped on the Desktop.
Encrypting and renaming of the files is deployed as the callback of the standard Golang function: path.filepath.Walk.
Files are encrypted with AES-256 (32 byte long key) in GCM mode.
The encryption algorithm is similar to the one demonstrated here. Using a hardcoded key and 12 bytes long nonce, generated by CryptGenRandom. The file content is encrypted with the help of the gcm.Seal function.
The content of the output file (with .VAGGEN extension) contains:
the 12 bytes long nonce
the encrypted content
the 16 byte long GCM Tag
The hardcoded key “du_tar_mitt_hjart_mina_pengarna0” found inside the malware code is Swedish for “you take my heart my money”. Using this key, we can easily decrypt the content.
With all these elements, we can actually recover encrypted files without having to pay the ransom. It appears that the malware author has not received any payment so far at this Bitcoin address.
Unusually low ransom amount
Based on our findings, we believe this is not a sophisticated threat actor, nor affiliated with any of the big ransomware gangs such as Ryuk. The ransom amount is unusually low, and unlike professional ransomware, this attack can be recovered from fairly easy.
However, the phishing attack was well conceived and the template looks well designed, with a nice touch of adding canary tokens. It’s unclear at this point if the University of British Columbia was the sole target or not.
Crawling additional repositories created by the threat actor, we found other Word template files that have used a very similar macro to drop a coin miner. This casts more questions about the motivation behind this phishing attack.
We are grateful for the information shared with us by the University of British Columbia. This allowed us to paint a better picture of this attack and understand who the targets were.
Malwarebytes customers were already protected thanks to our signature-less Anti-Exploit layer.
