IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

‘Ransomware as a service’ threat targeting enterprise servers

The PureBasic-written malware is highly unconventional and has ties to well-known organisations

An unusual ransomware strain, closely linked with forms used by known threat groups, is being used in targeted attacks against enterprise production servers.

The malware has been dubbed PureLocker, because it's been written in the PureBasic programming language, and is fitted with several features that lend well to evasion. The cyber criminals behind PureLocker are also deploying a Linux variant to attack its targets' Linux infrastructure.

Several factors render PureLocker unconventional, according to a joint analysis by Intezer and IBM X-Force researchers, including the fact PureBasic is uncommon and an unusual choice. It does bring certain advantages for the attackers, though.

Vendors, for example, have difficulty generating reliable detection signatures for PureBasic strains, while the code is also highly portable between different operating systems including Windows, Linux and macOS.

Evidence also suggests PureLocker is part of a targeted and multi-stage attack that goes through a series of checks before deeming whether or not the conditions are right to strike.

This covert method includes checking for whether the machine is dated to 2019, and whether admin rights are granted. If the checks fail, the malware will exit without performing any malicious activity in order to hide its functionality.

"PureLocker is a rather unorthodox ransomware," Intezer researcher Michael Kajiloti said. "Instead of trying to infect as many victims as possible, it was designed to conceal its intentions and functionalities unless executed in the intended manner.

"This approach has worked well for the attackers who have managed to successfully use it for targeted attacks, while remaining undetected for several months."

Another unconventional feature of PureLocker is that it uses what's known as an anti-hooking technique to evade detection. Hooking is conventionally used for purposes like debugging, and can also be deployed be malicious code to make themselves invisible. This form of anti-hooking deployed by PureLocker is a known trick rarely used in ransomware.

The malware also doesn't use Windows' built-in cryptographic API functions, instead relying on a crypto library compiled in PureBasic for its specific encryption requirements.

"This type of behavior is not common in ransomware, which typically prefer to infect as many victims as possible in the hopes of gaining as much profit as possible," Kajiloti continued. "Additionally, being a DLL file designed to be executed in a very specific manner reveals this ransomware is a later-stage component of a multi-stage attack."

PureLocker has ties with the "more_eggs" backdoor malware that has been spotted being sold on the dark web by a malware as a service (MaaS) provider. It's also been used by organisations like the Cobalt Gang, FIN6, and other prominent organisations.

The fact that the code of the evasion and anti-analysis functionalities is directly copied from the "more_eggs" backdoor loader allows PureLocker to stay undetected by automated analysis systems.

Featured Resources

Meeting the future of education with confidence

How the switch to digital learning has created an opportunity to meet the needs of every student, always

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

Technology reimagined

Why PCaaS is perfect for modern schools

Free Download

Recommended

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021
US and Israel join forces to fight ransomware
ransomware

US and Israel join forces to fight ransomware

15 Nov 2021

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

7 Jun 2022
Attracting and retaining talent through training
Sponsored

Attracting and retaining talent through training

13 Jun 2022
Delivery firm Yodel disrupted by cyber attack
cyber attacks

Delivery firm Yodel disrupted by cyber attack

21 Jun 2022