Dharma Ransomware-as-a-Service Attacks; ‘Have Fun Bro’

The global COVID-19 pandemic has left many organisations with a need to equip and enable an unexpectedly remote workforce, which has, in turn, left small companies with vulnerable infrastructure and devices, exposing them to potential malware attacks.

According to the Color by Numbers: Inside a Dharma Ransomware-as-a-Service (RaaS) Attack report by Sophos that provides the first in-depth look at an automated attack script and toolset created by the ransomware operators and provided to cybercriminal buyers together with back-end infrastructure and malicious tools, the attack targets small and mid-sized businesses (SMBs) affected by the novel coronavirus.

Dharma has been known since 2016 as one of the most profitable ransomware families, due to its mass-market and service-based business model. Various iterations of its source code have been dumped online or offered for sale that right now there are so many variants of the code in existence.

The main targets for the Dharma RaaS attacks as analysed are SMBs, with 85 percent of attacks seen in 2020 focusing on exposed access tools like Remote Desktop Protocol (RDP) according to a ransomware recovery company, Coveware, which also found that Dharma ransom demands were generally quite low, at US $8,620 USD, on average.

“Dharma is fast-food franchise ransomware, widely and easily available to just about anyone,” said Sean Gallagher, Senior Threat Researcher at Sophos. “Dharma’s ransomware-as-a-service offerings expand the range of people who can execute devastating ransomware attacks.”

The attack is worrying enough in itself at normal times. Right now, with many businesses adapting to the pandemic and accommodating a need for rapid support for remote workers, and IT staff stretched thin, the risk from the attacks is magnified.

The need to equip and enable an unexpectedly remote workforce has left small companies with vulnerable infrastructure and devices, hindering the ability of IT support staff to adequately monitor and manage systems the way they would under normal circumstances.

As noted in the Sophos report, once Dharma customers, known as affiliates, purchase the tools and compromise their targets, they rely almost entirely on a menu-driven PowerShell script that then installs and launches the components required to spread ransomware across the target’s network.

When the master script is executed, it identifies itself as “Toolbox” and launches the attack with the message, “Have fun, bro!”

The attack process relies heavily on the abuse of open source tools, as well as freeware versions of commercial tools. Its decryption is a surprisingly complex two-stage process.

Targets that contact affiliates for recovery keys are given a first-stage tool that extracts details of all of their encrypted files. Affiliates then share this extracted data is with their operators, who provide a second-stage decryption key for the files.

How effective this process is in restoring data for the targets depends greatly on the skills and mood of the affiliates, according to the research. For instance, Sophos occasionally observed affiliates hold back some of the keys as leverage to make additional ransom demands.

“With so many multi-million dollar ransom demands, high profile targets and advanced adversaries like WastedLocker now making the headlines, it can be easy to forget that threats like Dharma are alive and enabling a whole other rung of cybercriminals to hit multiple smaller targets to rake in a fortune, eight thousand dollars at a time,” said Gallagher in conclusion.