IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

‘Ransomware as a service’ threat targeting enterprise servers

The PureBasic-written malware is highly unconventional and has ties to well-known organisations

An unusual ransomware strain, closely linked with forms used by known threat groups, is being used in targeted attacks against enterprise production servers.

The malware has been dubbed PureLocker, because it's been written in the PureBasic programming language, and is fitted with several features that lend well to evasion. The cyber criminals behind PureLocker are also deploying a Linux variant to attack its targets' Linux infrastructure.

Several factors render PureLocker unconventional, according to a joint analysis by Intezer and IBM X-Force researchers, including the fact PureBasic is uncommon and an unusual choice. It does bring certain advantages for the attackers, though.

Vendors, for example, have difficulty generating reliable detection signatures for PureBasic strains, while the code is also highly portable between different operating systems including Windows, Linux and macOS.

Evidence also suggests PureLocker is part of a targeted and multi-stage attack that goes through a series of checks before deeming whether or not the conditions are right to strike.

This covert method includes checking for whether the machine is dated to 2019, and whether admin rights are granted. If the checks fail, the malware will exit without performing any malicious activity in order to hide its functionality.

"PureLocker is a rather unorthodox ransomware," Intezer researcher Michael Kajiloti said. "Instead of trying to infect as many victims as possible, it was designed to conceal its intentions and functionalities unless executed in the intended manner.

"This approach has worked well for the attackers who have managed to successfully use it for targeted attacks, while remaining undetected for several months."

Another unconventional feature of PureLocker is that it uses what's known as an anti-hooking technique to evade detection. Hooking is conventionally used for purposes like debugging, and can also be deployed be malicious code to make themselves invisible. This form of anti-hooking deployed by PureLocker is a known trick rarely used in ransomware.

The malware also doesn't use Windows' built-in cryptographic API functions, instead relying on a crypto library compiled in PureBasic for its specific encryption requirements.

"This type of behavior is not common in ransomware, which typically prefer to infect as many victims as possible in the hopes of gaining as much profit as possible," Kajiloti continued. "Additionally, being a DLL file designed to be executed in a very specific manner reveals this ransomware is a later-stage component of a multi-stage attack."

PureLocker has ties with the "more_eggs" backdoor malware that has been spotted being sold on the dark web by a malware as a service (MaaS) provider. It's also been used by organisations like the Cobalt Gang, FIN6, and other prominent organisations.

The fact that the code of the evasion and anti-analysis functionalities is directly copied from the "more_eggs" backdoor loader allows PureLocker to stay undetected by automated analysis systems.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
US government warns of increased risk of ransomware over holiday season
ransomware

US government warns of increased risk of ransomware over holiday season

24 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021

Most Popular

Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Costa Rica declares state of emergency following Conti ransomware attack
ransomware

Costa Rica declares state of emergency following Conti ransomware attack

10 May 2022