Boeing and X Bank Hit by LockBit 3.0 Ransomware Attacks: Reflecting on Necessary Defensive Changes Through Analysis

On November 10, the LockBit ransomware gang published data stolen from Boeing on its website, most of which are backups of various systems, with the latest data timestamped October 22.

Boeing page on the LockBit data leak site

▍What data of Boeing was leaked?

The sample of leaked data appears to include gigabytes of stolen data, ranging from training materials to lists of the company's technical suppliers.

The data allegedly includes the names, locations, and phone numbers of Boeing's suppliers and distributors in Europe and North America.

Information on the suppliers shows the support they provide within the corporate structure, including fuselage manufacturing, structural mechanics, computer and electronic equipment, etc. The data also contains information on customers and their suppliers.

Sample of leaked data

The leaked material also includes the company's 2018 strategic documents detailing Boeing's forecast for pilot demand through 2027, as well as 2018 market research data covering hundreds of different suppliers and contractors.

The company's financial details include sales, rebates, Cost of Poor Quality (COPQ) reports, net cost pricing, and 2020 list price data.

Other details include information in folders named "hazardous waste", "rotorcraft", and "business case", as well as documents of Boeing's internal training materials detailing how to connect to specific systems and who has access to them.

Sample of leaked data

▍LockBit[.]BLACK (V3.0) Analysis

The LockBit gang's notorious ransomware variant, LockBit 3.0 (also known as LockBit Black), is the third version of the LOCKBIT Windows ransomware family and is considered the most evasive of all previous variants. Previous versions include LOCKBIT and LOCKBIT.V2.0.

• LOCKBIT[.]BLACK (V3.0) is a Windows ransomware family written in C, capable of encrypting local files and shared network drives; it can propagate using Group Policy Objects.

• Encrypted files are renamed to include the generated file extension, and the ransom note is written to the directory containing the encrypted files.

• LOCKBIT[.]BLACK (V3.0) may tamper with Windows Defender settings and Windows Event Logs, turn off firewalls, enable all network shares, disable selected services, and create tasks to terminate the process list.

• LOCKBIT[.]BLACK (V3.0) shares a substantial amount of code with BLACKMATTER, including anti-analysis, anti-debugging, and overlapping Application Programming Interface (API) obfuscation code within the application.

SycSec has also observed a significant amount of code overlap between LOCKBIT[.]BLACK (V3.0) and recent BLACKMATTER samples.

LOCKBIT[.]BLACK File Characteristics

▶ Persistence Mechanism

If the malware is executed with the parameter "–safe", it will create the following registry key:

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\<random_str>

Value: <sample_exe> -pass <passkey>

▶ Host-Based Indicators

File System Characteristics

Create the following file, where "HLJkNskOq" represents a string generated by the malware:

Filename: HLJkNskOq[.]README[.]txt

Description: Ransom note Filename: < filename >.HLJkNskOq

Description: Encrypted file.

Filename: %CSIDL_COMMON_APPDATA%\HLJkNskOq[.]ico

Description: Encrypted file icon.

Filename: %CSIDL_COMMON_APPDATA%\<temp>.tmp.

Description: Copy of the malware.

Registry Characteristics

Create the following registry key:

Path: HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Status\"DED842482D87C83B0CDBFF5A9AA514F6D09C2D4C1F4AC2A9B9202D2A2D28714E"

Value: 1

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE\”DisablePrivacyExperience”

Value: 1

Path: HKCR\HLJkNskOq\DefaultIcon

Value: %CSIDL_COMMON_APPDATA%\HLJkNskOq[.]ico

Mutation Characteristics

Mutex: Global\2cae82bd1366f4e0fdc7a9a7c12e2a6b

▶ Network-Based Indicators

Anti-Analysis

LOCKBIT[.]BLACK (V3.0) uses multiple techniques to hinder analysis. The malware requires a password to decrypt its sections and execute. It also utilizes hash-based imports to obfuscate its capabilities; its strings are encoded using hash algorithms and compressed using the APLib library.

In addition, the malware employs various anti-debugging techniques, including:

• Hiding process threads from debuggers using the NtSetInformationThread API

• Using anti-debugger instructions such as "cpuid" and "rdtsc"

• Corrupting the first 32 bytes of the DbgUiRemoteBreakin API to prevent debuggers from attaching to the malware's process

▶ Initialization and Privilege Escalation

Upon startup, the malware checks if any command-line arguments are provided. The sample analyzed in this report requires a password "db66023ab2abcb9957fb01ed50cdfa6a" to be input via the -pass command-line argument to decrypt its .text, .data, and .pdata sections using the RC4 algorithm.

The malware utilizes several techniques to elevate its privileges, including the following:

• Attempting to execute known UAC bypass techniques using the CMSTPLUA COM interface to spawn its own elevated process and terminate if the current process is not running as administrator, or if the OS version is Windows 7 or earlier.

• Enabling multiple privileges for itself, including shutdown, volume management, user impersonation, and file content modification privileges.

• Checking whether the current user account is a local system account by inspecting the SID of the current user. If it is a local system account, this sample will set the Discretionary Access Control List (DACL) of the default desktop, allowing every user to access it. If the current user account is not a local system account, the sample will attempt to duplicate the token of explorer[.]exe. If the sample does not duplicate a qualified token from explorer[.]exe, and if the process token has administrator privileges, it will attempt to retrieve and duplicate the primary process token by logging into the user's access token via the WTSQueryUserToken API.

• Attempting to log into the domain controller using the username "administrator" and password "start".

▶ Command-Line Arguments

When only the -pass argument is provided, the sample encrypts all local drives and shared network resources using the ChaCha 256-bit algorithm. The malware is capable of accepting command-line arguments to enable the following features:

-path

When the -path argument is provided, the malware encrypts files in the given path. If a server path is specified, the malware will enumerate all network shares of the server and encrypt files on the server. The path can also be a drive specified in the "Volume{<Volume_GUID>}" format.

-safe

When the -safe argument is provided, the malware restarts the system in safe mode. First, the malware checks if the following mutex exists, and creates it if it does not:

Global\2cae82bd1366f4e0fdc7a9a7c12e2a6b

Next, if configured to do so, the malware extracts the embedded PE file as %CSIDL_COMMON_APPDATA%\<temp>.tmp and executes it to delete itself.

Then, the malware checks whether the system is a domain controller. If so, the malware performs the following operations before encrypting files:

• Sends beacons to C&C (if configured to do so)

• Spawns the malware process on the domain controller

• Deletes security-related driver services:

Sppsvc

WinDefend

WSVC

• Deletes shadow copies using WMI queries

• Terminates services and processes containing any predefined keywords

• Clears event logs from Windows Event Viewer and Event Log services and disables system logging

If the system is already running in safe mode, the malware forces the system to run the sample in safe mode by setting the following registry key and then restarting.

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\<random_str>

Value: <sample_exe> -pass db66023ab2abcb9957fb01ed50cdfa6a

If the system is not a domain controller and the system was not booted in safe mode, the following actions are executed:

• Delete security driver services.

• Set the following registry values for auto-logon:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon=49 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName=<username> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName=<domainname>

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword=<password>

Disable the Windows 10 privacy experience by setting the following registry key:

HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience

Value: 1

• Set the wallpaper (Figure 1) and configure system boot items when in safe mode by executing the following commands:

Windows 7 or later OS: bcdedit /deletevalue {current} safeboot

bootcfg /raw /a /safeboot:network /id 1

-wall

When the -wall argument is provided, this malicious file drops a file named HLJkNskOq[.]bmp and sets it as the wallpaper through the following registry configuration:

• HKCU\Control Panel\Desktop\WallPaper

Value: %CSIDL_COMMON_APPDATA%/HLJkNskOq[.]bmp

• HKCU\Control Panel\WallpaperStyle

Value: 10

Print physical copies of the ransom note.

-psex

When the -psex argument is provided, the malware attempts to connect to the ADMIN share of all systems in Active Directory to drop a copy of the malware named < generated_filename >.exe located in the Temp directory.

-del

When the -del argument is provided, if the malware is executing on a domain controller, the malware copies itself to %CSIDL_COMMON_APPDATA%\<temp>.tmp, executes, and then deletes the file.

-gdel

Depending on other arguments provided, the -gdel flag can disable lateral movement (-psex) or disable group policy updates (-gspd).

-gspd

When the -gspd argument is provided, the malware checks whether it is running on a domain controller in the context of a domain administrator. If so, the malware may attempt to update the group policy of all systems within the network. Once implemented, the GPO allows the malware to propagate to other systems, turn off Windows Defender and firewalls, enable all network shares, disable selected services, and create tasks to terminate the process list.

▶ Encryption

The sample generates an extension that will be appended to the filename of any encrypted file. Upon execution, the sample generates the string "HLJkNskOq" analyzed for this report. In addition, the ransomware creates an icon and sets it as the default icon for encrypted files by modifying the following registry key:

HKCR\HLJkNskOq\DefaultIcon

Value: %CSIDL_COMMON_APPDATA%\HLJkNskOq[.]ico

The malware does not encrypt files, folders, or files with extensions that it defaults to exempt. Files not on the exemption list are encrypted using the ChaCha 256-bit multi-threaded algorithm.

LOCKBIT BLACK BMP file

▍Overlaps Observed Between BLACKMATTER and LOCKBIT[.]BLACK (V3.0)

A comparison between LOCKBIT[.]BLACK (V3.0) (MD5: 38745539b71cf201bb502437f891d799) and BLACKMATTER (MD5: 479dcc649c66303e6561fc0d445bf884) samples exhibits a high degree of code overlap.

BLACK MATTER File Characteristics

Based on this analysis, we suspect that LOCKBIT[.]BLACK (V3.0) is an updated variant of BLACKMATTER, where LOCKBIT[.]BLACK (V3.0) generally has expanded capabilities in comparison. During the analysis, the following similarities were observed between LOCKBIT[.]BLACK (V3.0) and BLACKMATTER:

• Common anti-debugging techniques.

• Similar obfuscation techniques using the same XOR key.

• Both samples use IOCompletion ports for multi-threading.

• Both samples use the same import resolution method using encrypted pointers.

• Both samples use the same string hashing function.

• Both samples have very similar privilege escalation code, including the same UAC bypass techniques.

• Both samples use the same commands to enable safe mode and restart the system.

• For the -path command-line argument, LOCKBIT[.]BLACK (V3.0) and BLACKMATTER have the identical code.

• For the -wall command-line argument, both LOCKBIT[.]BLACK (V3.0) and BLACKMATTER create .bmp files to be set as wallpapers.

• The code structures for multi-threaded enumeration and file encryption in LOCKBIT[.]BLACK (V3.0) and BLACKMATTER are almost identical, despite differences in the algorithms used.

The following differences were observed between LOCKBIT[.]BLACK (V3.0) and BLACKMATTER:

• Unlike BLACKMATTER, the LOCKBIT[.]BLACK (V3.0) malware takes a -pass parameter required to decrypt its sections.

• The technique of corrupting DbgUiRemoteBreakin API bytes to prevent a debugger from attaching to the sample process is present only in LOCKBIT[.]BLACK (V3.0).

• Different functions are used to generate extensions for encrypted files.

• Only LOCKBIT[.]BLACK (V3.0) attempts to log into the domain controller.

• LOCKBIT[.]BLACK (V3.0) accepts additional command-line arguments.

• For the -safe command-line argument, LOCKBIT[.]BLACK (V3.0) has more features than BLACKMATTER, such as deleting services and shadow copies, sending network beacons, terminating processes, etc.

• LOCKBIT[.]BLACK (V3.0) has the capability to print physical copies of the ransom note using connected printers.

• LOCKBIT[.]BLACK (V3.0) has a mode to create and set group policies, allowing it to infect other systems in Active Directory.

• LOCKBIT[.]BLACK (V3.0) uses named pipes to communicate between processes. This capability is not seen in BLACKMATTER.

• LOCKBIT[.]BLACK (V3.0) can clear logs. This capability is not seen in BLACKMATTER.

• LOCKBIT[.]BLACK (V3.0) creates Windows services by itself. This capability is not seen in BLACKMATTER.

• LOCKBIT[.]BLACK (V3.0) uses the ChaCha algorithm for encryption, while BLACKMATTER uses Salsa20.

• Unlike BLACKMATTER, LOCKBIT[.]BLACK (V3.0) can drop itself into the ADMIN shares of other systems and encrypt files.

• Unlike BLACKMATTER, LOCKBIT[.]BLACK (V3.0) has anti-debugging techniques scattered throughout the sample.

• The stubs that are part of the import resolution routine have different code signatures to decrypt encrypted pointers in LOCKBIT[.]BLACK, unlike a single pattern in BLACKMATTER.

• BLACKMATTER uses vssadmin[.]exe to delete shadow copies, whereas LOCKBIT[.]BLACK uses WMI queries.

~~~ LockBit 3.0 the world’s fastest and most stable ransomware from 2019~~~

>>>>> Your data is stolen and encrypted.

If you don’t pay the ransom, the data will be published on our TOR darknet sites. Keep in mind that once your data appears on our leak site, it could be bought by your competitors at any second, so don’t hesitate for a long time. The sooner you pay the ransom, the sooner your company will be safe.

Ransom note sample

▍YARA Rules

The following YARA rules are not recommended for use on production systems, nor are they recommended to be set as blocking rules without verification through an organization's own internal testing processes, to ensure proper performance and limit the risk of false positives with no impact on your production systems. This rule focuses on serving as a starting point for hunting LOCKBIT[.]BLACK (V3.0) samples; however, if the malware family changes, it may need to be adjusted over time.

LOCKBIT[.]BLACK YARA Signatures

LockBit is one of the most resilient Ransomware-as-a-Service (RaaS) providers, having been active for over four years and causing thousands of victims across various sectors. Since 2020, the gang has launched nearly 1,700 attacks against multiple organizations in the US alone, extorting approximately $91 million.

In fact, the scope of LockBit's attacks covers the whole world, including Asia, Europe, and Africa. Recently, a US subsidiary of Bank X was also attacked by it, leading to the disruption of some systems. LockBit has been quite active this year; we have found that some 0-day vulnerabilities disclosed in recent months (e.g., Citrix ADC) are also being exploited by this ransomware gang. Bank X could have prevented this cyber attack in advance.

SycSec suggests that enterprises pay attention to such global high-risk ransomware gangs, make defensive preparations in advance, and change the previous methods of detecting and defending against ransomware. Ransomware attacks have become APT-like, and defensive effectiveness should be reviewed from the perspective of the entire kill chain, rather than being limited to confirming defensive capabilities by detecting a few ransomware samples.

You can search for the keywords "LockBit" and "Citrix" in the SycSec Security Metric Validation Platform to obtain relevant attack simulation validation actions and related scenarios, thereby verifying whether your security defense system can effectively respond to ransomware attack methods, while ensuring harmlessness during validation in an industry-unique manner.