FIN8, a financially motivated threat group also known as Syssphinx, has been seen using a modified version of the Sardonic backdoor to carry out BlackCat ransomware attacks. Sardonic collects system information, executes commands and loads additional malware, and the group has also deployed White Rabbit ransomware.
Who is FIN8 and how does it use BlackCat ransomware?
The FIN8 group, aka Syssphinx, a financially motivated (FIN uses for it) cyber threat actor, has been observed using a modified version of the Sardonic backdoor to carry out BlackCat ransomware attacks.
FIN8, active since at least 2016, was previously known for infecting point-of-sale (PoS) systems with malware such as PUNCHTRACK and BADHATCH. MITRE ATT&CK notes that in June 2021 the group switched from targeting PoS devices to distributing ransomware variants, and it lists Sardonic among FIN8’s tools.
How does the Sardonic backdoor work?
The Sardonic backdoor is written in C++ and is capable of collecting system information, executing commands, and loading additional malware payloads as DLLs through a plugin system. However, the latest version of the backdoor contains significant changes; Most of the source code is intentionally rewritten in C to avoid detection.
In the analyzed event, Sardonic is embedded in a PowerShell script and deployed to the target system after initial access. The script then launches a .NET installer that decrypts and executes an injector module to run the implant within the newly created WmiPrvSE.exe process. Sardonic supports interactive sessions for the threat actor to execute malicious commands and can execute additional DLLs and shellcodes through plug-ins.
Among its features, the backdoor can drop arbitrary files and leak file contents from the compromised machine to the attacker’s infrastructure.
- Initial accessSardonic arrives embedded in a PowerShell script
- .NET installerThe script launches it after initial access
- Injector moduleThe installer decrypts and runs it
- Implant runsSardonic starts inside a newly created WmiPrvSE.exe process
- Plug-insExtra DLLs and shellcode run on the attacker’s command
Has FIN8 deployed ransomware before?
This is not the first time FIN8 has used ransomware. MITRE ATT&CK lists White Rabbit, Ragnar Locker and attempts to run Noberus among the ransomware activity linked to the group.
How can organizations reduce the risk?
The threat actor group is known to continuously improve its capabilities and malware distribution infrastructure, regularly improving its tools and tactics to avoid detection. In order not to be the target of attacks that can be carried out using Sardonic malware;
- Using comprehensive and reliable security solutions,
- Using current and licensed technologies,
- Keeping the system and applications in the current version,
- It is recommended that the shared IoC findings related to the malware campaign be blocked by the security solutions used.
Indicator Of Compromises
Sha256 Hashes
| 05236172591d843b15987de2243ff1bfb41c7b959d7c917949a7533ed60aafd9 |
| 0980aa80e52cc18e7b3909a0173a9efb60f9d406993d26fe3af35870ef1604d0 |
| 0e11a050369010683a7ed6a51f5ec320cd885128804713bb9df0e056e29dc3b0 |
| 2d39a58887026b99176eb16c1bba4f6971c985ac9acbd9e2747dd0620548aaf3 |
| 4e73e9a546e334f0aee8da7d191c56d25e6360ba7a79dc02fe93efbd41ff7aa4 |
| 5b8b732d0bb708aa51ac7f8a4ff5ca5ea99a84112b8b22d13674da7a8ca18c28 |
| 64f8ac7b3b28d763f0a8f6cdb4ce1e5e3892b0338c9240f27057dd9e087e3111 |
| 6cba6d8a1a73572a1a49372c9b7adfa471a3a1302dc71c4547685bcbb1eda432 |
| 72fd2f51f36ba6c842fdc801464a49dce28bd851589c7401f64bbc4f1a468b1a |
| 827448cf3c7ddc67dca6618f4c8b1197ee2abe3526e27052d09948da2bc500ea |
| 8cfb05cde6af3cf4e0cb025faa597c2641a4ab372268823a29baef37c6c45946 |
| ede6ca7c3c3aedeb70e8504e1df70988263aab60ac664d03995bce645dff0935 |
| edfd3ae4def3ddffb37bad3424eb73c17e156ba5f63fd1d651df2f5b8e34a6c7 |
You can find these IoCs, and IoCs belong to other ransomware groups on our GitHub Repo.