Osiris Ransomware

It has been reported that a new ransomware, dubbed Osiris ransomware, is involved in targeted cyber-attack campaigns against enterprise networks. This ransomware is distinct from earlier malware that used similar naming and constitutes a modern, sophisticated threat. Osiris is engineered to gain deep access within targeted networks before encrypting victim data and is frequently linked to pre-encryption data exfiltration, facilitating double-extortion attacks. The malware has been observed leveraging legitimate administrative tools and advanced evasion techniques to circumvent security controls and remain concealed until the final stage of the attack.

Infection Mechanism:

The Osiris ransomware attack typically begins with initial unauthorized access to the victim environment, after which attackers conduct data exfiltration prior to encryption. During this phase, legitimate tools such as Rclone are used to transfer sensitive data to attacker-controlled cloud storage services, including platforms like Wasabi. To evade security controls, the attackers deploy a malicious kernel driver named POORTRY, which masquerades as legitimate software and is abused through a Bring Your Own Vulnerable Driver (BYOVD) technique to gain kernel-level privileges and disable endpoint security solutions. Following successful defense evasion, additional tools such as MeshAgent, Netscan, Netexec, Mimikatz variants and modified RustDesk are deployed to facilitate remote access, credential harvesting and lateral movement across the network.

Once sufficient access is achieved, Osiris ransomware is executed to encrypt files on compromised systems, appending the “.Osiris” extension to encrypted data. The ransomware selectively avoids encrypting certain system directories, including the Windows folder and Recycle Bin, as well as specific file types, in order to preserve system stability and ensure that ransom instructions remain accessible. To further prevent recovery, Osiris terminates multiple enterprise and system processes and services, including SQL services, Microsoft Exchange, backup applications, and Microsoft Office components and deletes Volume Shadow Copy Service (VSS) snapshots.

The malware employs a hybrid encryption scheme combining elliptic curve cryptography (ECC) with symmetric encryption algorithms such as AES-128, generating unique encryption keys for individual files. Upon completion of the encryption process, Osiris creates a ransom note file named “Osiris-MESSAGE.txt” containing attacker contact details and instructions for ransom negotiation.

Indicator of Compromise:

Hashes:

• fff586c95b510e6c8c0e032524026ef22297869a86d14075cd601ca8e20d4a16
• c74509fcae41fc9f63667dce960d40907f81fae09957bb558d4c3e6a786dde7d
• fc39cca5d71b1a9ed3c71cca6f1b86cfe03466624ad78cdb57580dba90847851
• 824e16f0664aaf427286283d0e56fdc0e6fa8698330fa13998df8999f2a6bb61

Files:

• 33[.]exe
• Payload[.]exe
• Payload[.]dll
• Kaz[.]exe
• Payload[.]dll

Domain:

• ausare[.]net
• wesir[.]net

For detailed list of IoC, kindly refer the below URL:

• https://www.security.com/threat-intelligence/new-ransomware-osiris

Best Practices and Recommendations:

• Maintain offline backups of data, and regularly maintain backup and restoration. This practice will ensure the organization will not be severely interrupted, and have irretrievable data.
• Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted) and covers the entire organization’s data infrastructure.
• Implement all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts) to have strong, unique passwords.
• Implement multi-factor authentication for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.
• Consider restricting/disabling command-line and scripting activities and permissions.
• Disable unused ports & services. Priortize hardening of internet-facing systems.
• Remove unnecessary access to administrative shares.
• Use a host-based firewall to only allow connections to administrative shares via server message block (SMB) from a limited set of administrator machines.
• Enable protected files in the Windows Operating System to prevent unauthorized changes to critical files.
• Disable Remote Desktop Connections, employ least-privileged accounts. Limit users who can log in using Remote Desktop, set an account lockout policy. Ensure proper RDP logging and configuration.
• Check regularly for the integrity of the information stored in the databases.
• Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems.
• Establish Domain-based Message Authentication, Reporting, and Conformance (DMARC), DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
• Keep the operating system, software and firmware up-to-date with the latest patches. Prioritize patching known exploited vulnerabilities in internet-facing systems.
• Application white listing/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
• Maintain updated Antivirus software on all systems.
• Don't open attachments in unsolicited emails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs, close out the email and go to the organization's website directly through the browser.
• Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
• Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
• Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
• Restrict access using firewalls and allow only to selected remote endpoints, VPN may also be used with a dedicated pool for RDP access.
• Use strong authentication protocols, such as Network Level Authentication (NLA) in Windows.
• Additional Security measures that may be considered are:
• Use RDP Gateways for better management.
• Change the listening port for Remote Desktop.
• Tunnel Remote Desktop connections through IPSec or SSH.
• Two-factor authentication may also be considered for highly critical systems.
• If not required consider disabling PowerShell / windows script hosting.
• Restrict users' abilities (permissions) to install and run unwanted software applications.
• Enable personal firewalls on workstations.
• Implement strict External Device (USB drive) usage policy.
• Employ data-at-rest and data-in-transit encryption.
• Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
• Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
• Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empanelled auditors. Repeat audits at regular intervals.
• Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies.

References:

• https://www.security.com/threat-intelligence/new-ransomware-osiris
• https://www.webpronews.com/osiris-ransomwares-driver-hijack-poortry-powers-a-stealthy-new-threat/