Sodinokibi Ransomware Spreads Wide via Hacked MSPs, Sites, and Spam

With the GandCrab Ransomware operation shutting down, affiliates are looking to fill the hole left behind with other ransomware. Such is the case with the Sodinokibi Ransomware, whose affiliates are using a wide range of tactics to distribute the ransomware and earn a commission.

This is shown in a wave of attacks involving the hacking of legitimate sites and replacing a download with Sodinokibi, hacking into managed service providers (MSPs) to push Sodinokibi to managed endpoints, and by utilizing spam campaigns for a wide net.

All of these distribution campaigns end with the same result; a victim who has their files encrypted and a ransom note explaining how to pay a ransom to get them back.

Below we outline three recent campaigns that Sodinokibi affiliates have been using over the past couple of days to gain wider distribution of the ransomware and thus more payments.

Managed Service Provider (MSP) Hacks

Similar to a previous MSP hacks by GandCrab affiliates, news started circulating yesterday on the /r/msp Reddit about MSPs being hacked to push Sodinokibi Ransomware to clients.

Sodinokibi affiliates conducted these attacks by reportedly accessing the networks via Remote Desktop Services and then utilizing the MSP's management console to push ransomware installers to all of the end points that they manage.

Kyle Hanslovan, the CEO of MSP security provider Huntress Labs, told BleepingComputer that one of the attacks against a large MSP appears to have been through their Webroot Management Console.

A picture of a MSPs Webroot Management Console that was posted to the Reddit thread shows a PowerShell command being pushed to all of the end points.

As first reported by ZDNet, in order to disrupt ongoing and future attacks, Webroot emailed customers to tell them that they have logged everyone out of their Webroot Management Consoles and enabled mandatory 2FA.

According to Hanslovan, a second attack appeared to have used the MSP's Kaseya VSA console to push a file called 1488.bat to end points and execute it. Once executed, it would install the ransomware.

"Later in the afternoon we were contacted by two customers from the same MSP who suggested they were also compromised. However, they claimed they had proof it was VSA that was used to execute their ransomware. They provided redacted screenshots of their Kaseya VSA dashboard which showed how VSA was used to run a batch file named 1488.bat (a similar named used in another targeted MSP attack we observed a few weeks ago). We have not analyzed this batch script as were waiting to hear back."

BleepingComputer was able to gain access to the 1488.bat batch file and it contained an base64 encoded PowerShell command that decodes to the following script. When executed the script will download and execute a script from Pastebin, which includes a base64 encoded Sodinokibi installer.

Finally, Hanslovan told BleepingComputer that a third MSP was hacked where the attackers pushed the ransomware through ConnectWise Control.

"Lastly, we’ve been notified by one additional partner today who is not managed by the affected MSP that they too were compromised is a similar way today. In this case, Webroot was disabled from the management console. However, ConnectWise Control (ScreenConnect) was used to install the ransomware."

In total Hanslovan has been told 200 hosts were successfully encrypted by the Sodinokibi Ransomware.

"We’ve been told up to 200 hosts were successfully encrypted which is a very small number compared to the number of hosts managed by these MSPs."

Booking.com Spam

Affiliates have used spam campaigns in the past to distribute the Sodinokibi Ransomware and continued to do so today.

A new spam campaign was discovered by security researcher TG Soft that pretends to be a "New Booking" on Booking.com.

Attached to this email is a malicious Word document with names like "Booking.com - 1571165841.doc" that asks you to "Enable Content" in order to access the booking information.

Once you enable the content, though, embedded macros will download Sodinokibi from a remote site and execute it.

WinRar distributor site hacked

Sodinokibi affiliates are also targeting sites that host downloads in order to replace legitimate software with the ransomware installer. According to TG Soft, a distributor for WinRar in Italy was hacked to distribute the ransomware installer.

"Yesterday in the afternoon the file downloaded was Sodinokibi instead of setup of WinRar," TG Soft told BleepingComputer in conversations.

You can see a process graph below for an Any.Run session that shows how the winrar-x64-571it (1).exe file was actually an installer for the ransomware.

BleepingComputer has contacted the distributor but we have not heard back as of yet and their site has been taken down while they resolve the issue.

BleepingComputer had also reached out to win.rar GmbH regarding the attack who stated:

"The website which has been hacked is the website www.winrar.it/, which is run by our Italian distributor. It is not our website, but the one of our distributor and it has been victim of a hacker attack."