FlagThis

A new ransomware variant, dubbed "Elpaco," has been identified as a customized version of the Mimic ransomware family. This advanced malware utilizes the Everything library for efficient file searching, enabling rapid encryption of user data. Elpaco also boasts a user-friendly graphical user interface (GUI) allowing attackers to easily customize its operations, further enhancing its effectiveness and evasiveness. The malware's deployment method is noteworthy, employing a 7-Zip installer mechanism, which helps it evade detection by standard security tools.

Elpaco's capabilities extend beyond basic file encryption. The ransomware incorporates mechanisms to disable security measures and execute system commands, demonstrating a high level of sophistication. This suggests attackers can leverage the malware to achieve further objectives beyond data encryption, potentially including data exfiltration or lateral movement within a compromised network. The use of the Everything library mirrors techniques observed in previous Mimic variants, indicating a possible evolution or adaptation of existing tactics.

Security researchers have noted that attackers often gain initial access through brute-forcing Remote Desktop Protocol (RDP) connections, followed by privilege escalation through exploitation of vulnerabilities such as CVE-2020-1472 (Zerologon). This highlights the importance of robust security practices, including strong password policies and timely patching of known vulnerabilities. The sophisticated nature of Elpaco underscores the ongoing need for advanced threat detection and response capabilities to combat increasingly complex ransomware attacks.

ImgSrc: media.kasperskycontenthub.com

References:

• Malware Analysis, News and Indicators - Malware News post about Elpaco ransomware. - 29d
• Securelist - Kaspersky blog post analyzing Elpaco ransomware. - 29d
• www.cyfirma.com - Elpaco Team Ransomware: A New Variant of the Mimic Ransomware Family - 29d
• www.trendmicro.com - Trend Micro's report on the original Mimic ransomware. - 29d
• opentip.kaspersky.com - OpenTIP analysis of Elpaco ransomware sample. - 29d
• attack.mitre.org - MITRE ATT&CK provides context on the techniques used by Elpaco. - 29d
• attack.mitre.org - MITRE ATT&CK techniques used by the Elpaco ransomware. - 29d

Classification:

• HashTags: Ransomware MalwareAnalysis Elpaco
• Company: Kaspersky
• Product: Mimic Ransomware
• Feature: Ransomware Customization
• Type: Ransomware
• Severity: Major