Security experts have uncovered a series of close links between ransomware groups Mount Locker and Astro Locker Team, in a new report that will be of interest to incident responders.

Sophos’ Managed Threat Response (MTR) team said it recently dealt with an attack that had all the TTPs of a Mount Locker operation. However, when it followed the link in the ransom note, the researchers were met by a ‘support’ team who introduced themselves as “Astro Locker Team.”

On further investigation, the MTR found all five of the victim organizations listed on the Astro Locker Team leak site were also on the equivalent Mount Locker site. It also found that some of the leaked data linked to on the Mount Locker site was being hosted on the Astro Locker onion site.

“In recent incidents where Sophos experts investigated and neutralized an active Mount Locker attack, we noticed various techniques that suggest these attackers are not as sophisticated as other ransomware groups like Ryuk, REvil and DoppelPaymer,” said Peter Mackenzie, manager of Sophos’s Rapid Response team.

“It is possible that the Mount Locker group wants to rebrand themselves to create a new and more professional image, or it could be an attempt to kickstart a true ransomware-as-a-service (RaaS) program. Regardless, if any organizations become a victim of Astro Locker in the future, they should investigate the TTPs of both Mount Locker and Astro Locker.”

Mackenzie argued that Mount Locker could be using the Astro name to pretend the group has a major new affiliate for its new RaaS program, or it may be a legitimate deal designed to accelerate its transition to becoming a RaaS operation.

“Branding is a powerful force for ransomware groups. Good branding can come from a single threat group being skilled at hitting high value targets and avoiding detection — such as DoppelPaymer — or by running a successful RaaS network — like Sodinokibi or Egregor. Powerful branding with ransomware groups can strike fear in targets and lead to a higher likelihood of payouts,” he concluded.

“Mount Locker has proven itself as a less sophisticated ransomware group, so a pivot to an affiliate program might be a way to create a new brand and move up the hierarchy of threat groups.”

Sophos also claimed that Mount Locker may be sharing some back-end services with the Ragnar Locker group, although the latter doesn’t seem to be part of its RaaS scheme yet.

The US authorities are urging Fortinet customers to patch three legacy vulnerabilities being exploited in the wild to compromise government, commercial and technology service provider networks.

A joint cybersecurity advisory from the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) on Friday warned that threat actors are actively scanning for devices via ports 4443, 8443 and 10443, with the potential end goals of data theft or ransomware deployment.

“The FBI and CISA believe the APT actors are likely exploiting these Fortinet FortiOS vulnerabilities — CVE 2018-13379, CVE-2020-12812, and CVE-2019-5591 — to gain access to multiple government, commercial and technology services networks,” it said.

“The APT actors may be using any or all of these CVEs to gain access to networks across multiple critical infrastructure sectors, to gain access to key networks as pre-positioning for follow-on data exfiltration or data encryption attacks. APT actors may use other CVEs or common exploitation techniques — such as spear-phishing — to gain access to critical infrastructure networks to pre-position for follow-on attack.”

Patches for the first two vulnerabilities have been available since May and July 2019, while the third was fixed by Fortinet in July last year.

CVE 2018-13379 is a patch traversal flaw which allows unauthenticated attackers to download system files, while CVE-2020-12812 is an improper authentication vulnerability in SSL VPN which allows users to log-in without being prompted for a second factor if they change their username case. Both have a CVSS score of 9.8, meaning they’re classed as “critical.”

CVE-2019-5591 is a default configuration vulnerability in FortiOS which could allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server. It has a score of 7.5, making it a high severity bug.

Fortinet said it had repeatedly urged customers to patch the offending vulnerabilities over the past couple of years.

Security researchers are warning LinkedIn users to beware of unsolicited job offers after revealing a new spear-phishing campaign designed to install Trojan malware on their devices.

The eSentire Threat Response Unit (TRU) yesterday claimed that individuals were being targeted with customized files named the same as their own current role.

“Upon opening the fake job offer, the victim unwittingly initiates the stealthy installation of the fileless backdoor, more_eggs. Once loaded, the sophisticated backdoor can download additional malicious plugins and provide hands-on access to the victim’s computer,” it continued.

“The threat group behind more_eggs, Golden Chickens, sell the backdoor under a malware-as-a-service (MaaS) arrangement to other cyber-criminals.”

Once more_eggs is installed, the backdoor can be used by Golden Chickens customers to further their own campaigns, by infecting with additional malware like ransomware, credential stealers and banking Trojans, warned eSentire. Backdoor access could also be used to find and exfiltrate sensitive data from the victims’ machine, it added.

The group is thought to be taking advantage of the high number of COVID-19 redundancies in the US to spread this email campaign, whilst including the victim’s own LinkedIn job position as the name of the malicious Zip file to increase the chances of them opening it.

The Trojan also abuses legitimate Windows processes such as WMI to evade detection by traditional AV tools.

The campaign is similar to one from 2019 in which employees of US retail, entertainment and pharmaceutical companies were targeted by the same more_eggs Trojan disguised as a job offer matching their own current position, eSentire claimed.

Noted Advanced Persistent Threat (APT) groups including FIN6, Cobalt Group and Evilnum have all been spotted in the past using more_eggs in their attacks, although it’s unclear who is behind the Golden Chickens group.