Introduction
Fox-IT’s Security Operations Center (SOC) observed fake Ziggo invoice e-mails, since October 6th 2016, linking to a ransomware variant known as TorrentLocker.
The group behind TorrentLocker has previously been observed using fake Dutch postal service emails imitating PostNL, back in 2014. This distribution method of abusing local postal service names was seen in a lot of countries where this threat was active. This was also documented in CERT PL’s report ‘Going Postal’ published last year. After continuous takedowns of the fake invoice domains with the help of Abuse.CH, the group seized their activities in the Netherlands, near the end of 2014, but continued in several other countries around the world.
The switch from using fake track and trace e-mail messages from postal services (from 2014 till 2016), to using fake invoices from a local Dutch ISP known as Ziggo, is an interesting switch in the modus operandi of the group behind TorrentLocker.
The reach of this e-mail campaign is rapidly increasing as a result of TorrentLocker stealing the address books from its victims to expand its list of new targets. Every successful infection increases the reach of the malicious e-mail campaign significantly.
Current phishing e-mail
The e-mail below is an example of the phishing e-mail, which mimics the real Ziggo invoice e-mails:
The e-mail above contains a link to a fake Ziggo page that will force the user to download a ZIP file with the supposed invoice inside. The ZIP file contains a JavaScript file which will, when executed by the victim, download the TorrentLocker ransomware from a compromised WordPress website. When the victim’s data is encrypted, TorrentLocker shows the screen below, still using the name ‘Crypt0L0cker’, as seen 2 years ago:
Indicators of compromise
Currently (October 6th 2016) active campaign distribution domain:
- ziggo-online23.org / 212.92.97.28
Other Ziggo domains used in previous e-mail campaigns:
- ziggo-online23.org
- ziggo-online12.com
- ziggo-online247.net
- ziggo-online24.net
- ziggo-online24.org
- ziggo-factuur84.org
- ziggo-factuur23.org
All domains registered by the group behind TorrentLocker are registered at REG.RU. With the continued effort of AbuseCH we have been taking down these domains as soon as they appear.
TorrentLocker initially communicates via SSL to several IPs to reach its command and control server. The current IP being used for this communication is:
- 185.40.152.22
The certificate used for this SSL connection typically contains the following static information (more sample and information for these SSL certificates can be found on AbuseCH’s SSL Blacklist):
- C=US, ST=Denial, L=Springfield, O=Dis
After the initial SSL connection, all other network communication is ran through Tor. Files encrypted by TorrentLocker will be appended by the ‘.enc’ extension. More details on the prevention of ransomware can be found in our earlier TorrentLocker blog: New Torrentlocker variant active in the Netherlands.