- Table of contents
The author
Table of contents
Related Articles
Into the Depths of Abyss Locker
Abyss Locker is a relatively new ransomware operation that is believed to have launched in March 2023, when it began to target companies in attacks.
The Abyss Locker ransomware group has evolved into a menace for a wide array of entities, including industrial control systems (ICS), enterprises, and public-sector organizations. This shift is attributed to the introduction of a specialized Linux encryptor designed to target VMware’s ESXi virtualized environments.
Abyss Locker’s transition is reflective of a broader pattern. The extensive adoption of the ESXi platform, coupled with the absence of third-party malware detection capabilities within the hypervisor that oversees the virtual machines (VMs), has rendered this technology an increasingly alluring focal point for ransomware operators.
The Abyss ransomware appears to rely on the HelloKitty ransomware infrastructure, however the encryption algorithm changed from AES to ChaCha.
Abyss Locker Victimology
The group has asserted responsibility for several data breaches, alleging that they have pilfered varying amounts of data, ranging from 35 GB in one company’s case to as much as 700 GB in another.
The higher number of victims in the United States indicates that it is likely the primary target for the Abyss ransomware, suggesting a significant focus on targeting entities within the USA.
Here are some examples for late victims who suffered from the Abyss Ransomware:
- Posen Architects
- MRA
- Van Wingerden Greenhouses
- Sunharbor Manor
- Finitia
- PLB International
- Brockhouse Group
- Tractrad.com
- arb Architekten
Abyss Locker Malware, Tools & TTPs
Similar to various other ransomware campaigns, the perpetrators behind Abyss Locker engage in a familiar sequence of actions. They infiltrate corporate networks, pilfer data to enable a double-extortion approach, and proceed to encrypt devices within the network.
This pilfered data subsequently becomes a bargaining tool, utilized to exert pressure by warning of data leaks unless a ransom is settled. For the purpose of leaking this stolen information, the threat actors have set up a Tor-based data leak site titled ‘Abyss-data,’ which currently features a roster of fourteen victims.
The encryptor initiates the shutdown of all virtual machines, facilitating the comprehensive encryption of associated virtual disks, metadata, and snapshots. This encryption encompasses files with extensions such as .vmdk (pertaining to virtual disks), .vmsd (linked to metadata), and .vmsn (associated with snapshots).
Beyond its focus on virtual machines, the ransomware further extends its impact to encompass all other files present on the device, appending the .crypt extension to their filenames.
The included ransom note provides details regarding the file situation and includes an exclusive hyperlink leading to the threat actor’s Tor-based negotiation platform. This platform is characterized by its simplicity, featuring only a basic chat panel meant for interactions with the ransomware group.
Abyss Locker Origins & Affiliates
In January 2023, a threat actor under the moniker “infoleak222” made a post on the now-defunct Breached forums, sharing a link to victim data that coincided with data also found on the Abyss Locker website. There’s a belief that these occurrences are interconnected, indicating that Abyss Locker activities were already underway many months prior to the publication of their TOR-based blog. Instances of previous Abyss variations, including a Windows variant, have been identified as far back as 2019.
Community
Abyss Locker operates as a multi-extortion group, maintaining a TOR-based website where victims’ information is displayed along with their exfiltrated data, in case they refuse to comply with the threat actor’s demands.
Abyss Locker TTPs
| Tactic | Technique |
|---|---|
| Defense Evasion | T1036.005 – Match Legitimate Name or Location |
| Initial Access | T1190 – Exploit Public-Facing Application |
| Exfiltration | T1537 – Transfer Data to Cloud Account |
| Exfiltration | T1567 – Exfiltration Over Web Service |
| Exfiltration | T1020 – Automated Exfiltration |
| Defense Evasion | T1078 – Valid Accounts |
| Persistence | T1078 – Valid Accounts |
| Privilege Escalation | T1078 – Valid Accounts |
| Execution | T1078 – Valid Accounts |
| Execution | T1569.002 – Service Execution |
| Execution | T1059.003 – Windows Command Shell |
| Persistence | T1547.009 – Shortcut Modification |
| Privilege Escalation | T1547.009 – Shortcut Modification |
| Exfiltration | T1041 – Exfiltration Over C2 Channel |
| Execution | T1059.001 – PowerShell |
| Discovery | T1016.001 – Internet Connection Discovery |
| Impact | T1486 – Data Encrypted for Impact |
| Initial Access | T1566.001 – Spearphishing Attachment |
| Initial Access | T1566.002 – Spearphishing Link |
| Defense Evasion | T1027.001 – Binary Padding |
| Collection | T1114.001 – Local Email Collection |
| Exfiltration | T1029 – Scheduled Transfer |
| Initial Access | T1195 – Supply Chain Compromise |
| Persistence | T1547.001 – Registry Run Keys / Startup Folder |
| Privilege Escalation | T1547.001 – Registry Run Keys / Startup Folder |
