In the ever-evolving landscape of cyber threats, a new player has emerged in the form of MalasLocker ransomware. This notorious ransomware variant has been active since March 2023 and has a distinct modus operandi: instead of demanding traditional ransom payments, it seeks charity donations. This unique twist sets it apart from other ransomware strains and poses a significant challenge for organizations targeted by this malicious group.
Targeted industries and regions
The MalasLocker group primarily focuses on corporate companies that offer various business services, software solutions, and manufacturing services. While their attacks have been observed in multiple regions, they appear to have a particular interest in targeting organizations in Italy, Russia, and the United States. This geographical spread highlights their international reach and emphasizes the need for heightened vigilance in these areas.
Method of attack
The threat actors behind MalasLocker employ sophisticated phishing techniques to target their victims. They distribute malicious JSP documents via phishing emails, specifically targeting users of Zimbra, a popular collaboration software suite. By enticing unsuspecting recipients to open these infected documents, the attackers gain unauthorized access to the victims’ systems.
Specific file upload locations
To further their nefarious objectives, the MalasLocker group uploads suspicious JSP files to specific directories within Zimbra servers. These files, such as heartbeat.jsp, info.jsp, and Startup1_3.jsp, are typically found in directories like /opt/zimbra/jetty_base/webapps/zimbra/ or /opt/zimbra/jetty/webapps/zimbra/public. This strategic placement allows the ransomware to propagate throughout the system, encrypting critical files and wreaking havoc on the victims’ infrastructure.
Exploiting Zimbra vulnerabilities
In addition to leveraging phishing techniques, the MalasLocker group takes advantage of vulnerabilities associated with Zimbra servers. These vulnerabilities include CVE-2022-27924 (Zimbra memcache command injection), CVE-2022-27925 (Zimbra admin directory traversal), CVE-2022-30333 (UnRAR Linux/UNIX directory traversal), and CVE-2022-37042 (Zimbra auth bypass, remote code execution). These vulnerabilities allow the threat actors to gain unauthorized access to the targeted systems. Exploiting these weaknesses gives the ransomware a foothold to carry out its encryption operations.
Encryption Software and File Extensions
To encrypt the victim’s files, the MalasLocker group utilizes the “AGE” encryption tool. Interestingly, they do not append any file extensions to the encrypted files, making it even more challenging for victims to identify the affected files and recover them. This deliberate choice by the attackers adds an extra layer of complexity to the decryption process.
Hosting a Tor website
To communicate with their victims, the MalasLocker group maintains a TOR website. On this site, they have published a list of 160 victims who have fallen prey to the ransomware. To protect the confidentiality of the affected companies, the group has censored the images representing their names. Interestingly, the welcome greeting on the TOR website indicates that the threat group is based in Spain, with a motto written in Spanish that roughly translates to “we are bad… we can be even worse.”
Ransom Note and Contact Details
The ransom note, provided in a file named Readme.txt, takes a unique approach compared to traditional ransom demands. Instead of asking for a specific ransom amount, the MalasLocker group requests charity donations to be made in exchange for the decryptor tools. The note includes instructions on how to make these donations and how to reach the threat group for further communication.
Prevention and best practices
As with any cybersecurity threat, prevention is key when dealing with MalasLocker ransomware. One of the primary measures organizations can take is to regularly patch and update their Zimbra applications to the latest version. Keeping software updated ensures that known vulnerabilities are addressed before threat actors can exploit them. Additionally, implementing robust phishing awareness training programs and maintaining strong email security measures can help mitigate the risk of falling victim to phishing emails.
MalasLocker ransomware represents a new breed of cyber threat that adopts novel tactics to achieve its objectives. By targeting Zimbra servers and demanding charity donations instead of traditional ransom payments, this group poses a significant challenge for organizations worldwide. It is crucial for businesses to stay vigilant, update their software regularly, and implement proactive cybersecurity measures to fend off such attacks. As the threat landscape continues to evolve, organizations must adapt their defenses accordingly to protect their valuable data and infrastructure from these malicious actors.