Log in Request a demo

Ransomware

[Research Summary]: Cylance Ransomware

Cylance ransomware technical analysis: how this Linux ELF ransomware may enter through unpatched services, misconfigurations and stolen credentials.

Updated 2 Min Read

Cylance ransomware is a ransomware family. Brandefense’s technical analysis covers its Linux executable, and a Windows version also exists. Attackers cannot count on phishing against servers and IoT devices, so they target unpatched services, misconfigurations, and default or compromised credentials. The missing data leak site suggests the ransomware is still at an early stage.

This blog post comes from the “Cylance Ransomware Technical Analysis Report” by the Brandefense Research Team. For more details about the analysis, download the report.

What Does the Cylance Ransomware Report Cover?

The report analyzes the executable file of Cylance ransomware targeting Linux systems, but there is also a version targeting Windows operating systems. 

Overview

File Name: d1ba6260e2c6bf82be1d6815e19a1128aa0880f162a0691f667061c8fe8f1b2c.elf
MD5: 4601076b807ed013844ac7e8a394eb33
SHA-1: 933ad0a7d9db57b92144840d838f7b10356c7e51
SHA256: d1ba6260e2c6bf82be1d6815e19a1128aa0880f162a0691f667061c8fe8f1b2c

How Does Cylance Ransomware Get Into a System?

Attackers looking to infiltrate servers and IoT platforms using ELF malware cannot rely on end-user interaction or phishing emails to install malware on their behalf, a widely expected behavior on Windows systems. This is because Linux environments are used in server and/or IoT devices with little end-user interaction, and attackers target these environments. 


Below, we have outlined how ELF malware can potentially infect systems.

  • Exploiting the Vulnerabilities

Attackers will target vulnerable and unpatched publicly available services or application components to gain access to systems. In addition to vulnerabilities, misconfigurations implemented on the services can also provide an entry point for attackers using ELF malware.

The attacker can use default or compromised credentials to access the system. Techniques such as password spraying and brute force are frequently used for this. 

Conclusion

The lack of a data leak site or support page, as with popular ransomware, suggests that the ransomware analyzed is still in its early stages, but given the increase in ransomware attacks targeting both Windows and Linux systems, it is thought that threat actors are trying to catch up with the trend.

Download YARA Rules and IoCs from GitHub.

This blog post comes from the “Cylance Ransomware Technical Analysis Report” by the Brandefense Research Team. For more details about the analysis, download the report.

Frequently Asked Questions.

What is Cylance ransomware?

It is a ransomware family. The Brandefense report analyzes its executable file for Linux systems, and the post says a version for Windows also exists.

How does ELF malware like Cylance ransomware get into a system?

Per the post, attackers exploit vulnerable, unpatched public services or application components, and misconfigurations, or use default or compromised credentials. MITRE ATT&CK describes the weakness in an Internet-facing system as a software bug, a temporary glitch or a misconfiguration.

Why does Linux ransomware not rely on phishing?

The post says Linux is mostly used in servers and IoT devices with little end-user interaction, so attackers cannot depend on users to install the malware.

Is Cylance ransomware still new?

The post says the lack of a data leak site or support page suggests it is in an early stage, and that threat actors are thought to be following the rise of ransomware against Windows and Linux.

Where can I get the YARA rules and IoCs?

The post links to the Brandefense IoC repository on GitHub.

Sources

  1. 1 MITRE ATT&CK: Exploit Public-Facing Application (T1190)
  2. 2 MITRE ATT&CK: Valid Accounts (T1078)
  3. 3 MITRE ATT&CK: Password Spraying (T1110.003)
Share

In This Article

TechniquesPhishing (T1566): ATT&CK Technique TermsRansomware TermsSecurity misconfiguration TermsLeaked credentials TermsData leak site TermsBrute force attack TermsThreat actor

Where To Next.

All Ransomware Articles
In plain words · Glossary term Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Open → Keep reading · Article The Rise of Ransomware-as-a-Service (RaaS): Understanding the Threat

RaaS lets developers rent out ransomware while affiliates run the attacks and share the profits.

Open → Keep reading · Article [Research Summary]: Mystic Stealer

Mystic Stealer is a stealer malware that first surfaced in April 2023.

Open →

Knowledge HubRansomware groups