Threat Intelligence Report January 7 - January 13 2025

FunkSec Ransomware

Group Emergence: FunkSec surfaced in late 2024, quickly claiming over 90+ victims since December.

Hacktivism-Cybercrime Blend: Some members have prior hacktivist links, and the group recycles data from older hacktivism campaigns, casting doubt on the authenticity of many leaks.

AI-Assisted Development: The group’s custom ransomware, written in Rust, appears to be generated or heavily supported by AI tools, accelerating its iteration despite the apparent inexperience of its developers.

Low Ransom Demands: Demands as low as $10,000, coupled with discounted data sales, increase their visibility in cybercrime forums.

Attack Methodology

• Double Extortion Tactics:
  • Data Theft: FunkSec steals sensitive files and threatens to publicly leak them.
  • File Encryption: The group encrypts victims’ data using a Rust-based malware (with RSA/AES/ChaCha20 mechanisms).
  • Ransom Demand: Victims are pressured to pay to both unlock their data and prevent public leaks.
• Rapid Iteration & Publicity:
  • Their RaaS (Ransomware-as-a-Service) offering is updated frequently (new versions released days apart).
  • The group boasts about low antivirus detection by posting VirusTotal screenshots.
• Hacktivist-Style Messaging:
  • Despite typical cybercriminal behaviours, FunkSec’s communications sometimes highlight political or ideological undertones, pointing to possible hacktivist elements.

Detailed TTPs

Initial Access & Privilege Escalation

• Uses various infiltration methods (not fully detailed in their statements) and checks for administrative rights using net session.
• When lacking privileges, the ransomware attempts to relaunch itself with elevated permissions (e.g., using PowerShell start-process -wait -Verb runas).

Defence Evasion

• Disables real-time monitoring in Windows Defender:
  
          Set-MpPreference -DisableRealtimeMonitoring $true
  
  
• Disables Security & Application event logging with wevtutil.
• Terminates processes/services (e.g., browsers, email clients, security tools) to prevent interference with encryption.

Once it has elevated privileges, the malware executes the following commands:

The terminate_processes function contains a hardcoded list of processes and services to terminate:

File Encryption Process

• Implements ChaCha20 (via Rust’s orion.rs crate) for symmetric file encryption.
• Uses ephemeral keys generated by CryptGenRandom.
• Targets multiple drive letters and recursively encrypts files, appending .funksec extension.

Data Exfiltration & Publishing

• Steals data and hosts breach announcements on a data leak site (DLS).
• Threatens to sell or leak stolen data if victims refuse to pay.

Ransom Note Delivery

• Drops a ransom note (readme.me) with instructions for payment and contact.
• The note references FunkSec and, in some versions, Ghost Algeria—further indicating a developer based in Algeria.

AI-Enhanced Development

• Rust source code comments show signs of LLM-generated text.
• FunkSec released an AI chatbot using Miniapps to automate or assist malicious tasks (e.g., code suggestions, version updates).
  
  

IOCs

How to Mitigate:

• Deploy Robust Endpoint Security
• Implement Least Privilege & Access Controls
• Maintain Strict Patch Management
• Perform Frequent, Secure Backups
• Segment and Harden Networks
• Monitor and Log Key Events
• Secure Email & Web Gateways
• Leverage AI Defensively

Ransomware Victims Worldwide

A recent ransomware analysis reveals a striking 47.47% of global incidents targeted the United States, solidifying its position as the hardest-hit country by a significant margin. Trailing behind, the United Kingdom experienced 8.08% of attacks, followed by France at 5.05%.

Other significantly affected countries include Australia, Germany, Italy, and Canada, each accounting for 3.03% of reported attacks. Meanwhile, Argentina, Peru, and Brazil each reported 2.02% of the total incidents.

Nations such as India, Europe, Switzerland, Romania, Paraguay, Poland, Bolivia, Dominican Republic, Turkey, Kenya, Netherlands, Belgium, Sweden, Thailand, Armenia, South Africa, Oman, Ireland, Spain, Colombia, and Japan each reported 1.01% of the total ransomware incidents, indicating a widespread—albeit lower-level—impact across various regions.

This analysis underscores the global and persistent nature of ransomware threats, with North America and parts of Europe continuing to bear the brunt of the attacks, followed closely by multiple regions worldwide. These findings highlight the urgent need for heightened cybersecurity measures and proactive defences across all areas to combat the ever-evolving ransomware landscape.