Ukraine CERT Warns on Somnia ransomware

Cyber experts from Ukraine discovered a new attack campaign by suspected Russian threat actors that compromise victims’ VPN accounts to access and encrypt networked resources.

The Somnia ransomware was being used by the FRwL (aka Z-Team), also identified as UAC-0118.

Initial compromise is achieved by tricking victims into downloading “Advanced IP Scanner” software which contains Vidar malware. CERTU-UA believes this was achieved by initial access brokers (IABs) working for the Russians.

Once inside, attackers conducted reconnaissance work using the Netscan tool and then launched Cobalt Strike Beacon, exfiltrating data using the Rclone program. There are also signs of the threat actors using Anydesk and Ngrok at this stage.

Advertisements

It’s unclear how widespread the campaign was, although “several” Ukrainian organizations are thought to have been impacted since spring 2022.

CERT-UA confirmed that the end goal is not to generate profits from a ransom but to destroy victim environments. The Somnia malware has also undergone changes. The first version of the program used the symmetric 3DES algorithm. In the second version, the AES algorithm is implemented.

At the same time, considering the dynamics of the key and the initialization vector, this version of Somnia, does not provide for the possibility of data decryption.

Indicators of Compromise