Threat Intelligence Report November 5 - November 11 2024

Helldown Ransomware Group Report

The Helldown Ransomware Group is an emerging threat actor specialising in ransomware attacks across various sectors. Their operations have expanded globally, targeting multiple industries and countries. This report provides detailed insights into their activities based on recent findings.

Key Findings

• New Domain Discovered: A new domain linked to Helldown has been identified, indicating active development and expansion.
• Indicators of Compromise (IOCs): Multiple file hashes, IP addresses, and domains have been associated with the group's malicious activities.
• Targeted Industries and Countries: The group targets a wide range of industries and countries, suggesting a broad attack surface.
• Attack Techniques: Utilisation of exploitation for privilege escalation and spear phishing attachments as primary attack vectors.

Detailed Tactics and Techniques

1. Spearphishing Attachment (T1193): The group uses targeted phishing emails with malicious attachments to gain initial access to victim networks. These attachments may contain malware or exploit code that, when opened, executes malicious payloads.
2. User Execution (T1204): Requires the user to perform an action to execute the malicious code, such as opening a file or enabling macros.
3. Boot or Logon AutoStart Execution (T1547): The malware may install itself to run automatically upon system startup or user logon.
4. Exploitation for Privilege Escalation (T1068):  Exploiting vulnerabilities in the operating system or installed applications to gain higher-level permissions.
5. Obfuscated Files or Information (T1027): The malware may use obfuscation techniques to hide its code and evade detection.
6. Disable Security Tools (T1562): Attempting to disable antivirus and other security solutions
7. Credential Dumping (T1003): Obtaining account credentials to move laterally within the network.
8. Network Service Scanning (T1046): Scanning the network to identify open services and potential targets.
9. Remote Service Execution (T1021): Moving between systems within the network using remote services.
10. Data from Local System (T1005): Collecting files and sensitive information from the infected system.
11. Exfiltration Over C2 Channel (T1041): Sending collected data back to the attacker over established Command-and-Control channels.

Infrastructure

• Domains and IP Addresses:
  
  
  • Domains:
    • helldown.org (surface web)
    • onyxcb44xvqra35m3lp3z26kf2pxrlbn64nbzvyvzjyc3uykzrwcjdid.onion (dark web)
  • IP Addresses:
    • Multiple IPs associated with their C2 infrastructure (e.g., 20.190.159.68, 51.11.168.232).
  • Usage:
    • Hosting Command-and-Control servers.
    • Data exfiltration points.
    • Hosting victim payment portals on the dark web.

Indicators of Compromise

A recent analysis of ransomware impacts across various countries highlights the United States as the most affected, with a dominant 62.24% of incidents. Following are the United Kingdom, which had 6.12% of the total attacks, and India, which had 4.08%. Canada, France, and the United Arab Emirates each recorded 2.04% of total incidents. Several other nations including Taiwan, Lebanon, Argentina, Chile, Netherlands, Brazil, South Africa, Peru, Luxembourg, Germany, Switzerland, Qatar, Czech Republic, Italy, Bosnia and Herzegovina, Ireland, El Salvador, Dominican Republic, Spain, Australia, and Uruguay observed minimal impacts at 1.02% each. This distribution underscores the global reach and varied impact of ransomware attacks, with a clear concentration in North America, particularly the United States.