Mar 22, 2024

※日本語版はこちら（For the Japanese version, please refer to here.）

Dr. Sareena K P, Dr. Manikantan Srinivasan
NEC Corporation India Pvt. Ltd.

Late 2022 observed an emergence of a new wave of ransomware attacks named as Fargo targeting vulnerable Microsoft Structured Query Language (SQL) servers [1]. Widely used across companies, Microsoft SQL servers are database management systems for storage and retrieval of data related to most Internet services and applications [2]. These servers pose as a lucrative target for making quick profit as disrupting their functioning can have severe repercussions. Research indicates that Fargo and its variants have been in the horizon since 2021. This ransomware is attributed to the TargetCompany group, which is known to vary the encryption strategies and the file extensions in each major release of its ransomware based on the attack target [3].

This malware seems to be quite active indicated by the considerable number of Fargo ransomware attacks reported on the ID ransomware platform[4]. While prior reports [1] [3] [5] [6] present the analysis and indicators of Fargo and its variants, we attempt to decode its encryption strategy, geo-sensitive policies, propagation strategies by comparing three variants namely, Fargo [1], Mallox [6] and Fargo.YACH2 [3]. We also map the behaviour of Fargo to MITRE Tactics and Techniques. Finally, we analyse the possibility of recovery of files encrypted by Fargo.

Key findings. Below are the key findings from our study.

Samples. This blog is based on the analysis of three samples:

Intermittent Encryption

For any ransomware, accelerating the encryption process is the key to increase the impact while making detection harder. Encryption process is both compute-intensive and I/O intensive. Consequently, detection mechanisms often rely on the intensity of the CPU and I/O operations as statistical indicators to detect ransomware. An encryption strategy that is both quick and light-weight, not only minimizes the time window for the defenders to respond, but also makes detection of ransomware challenging [7].

The latest technology aiding cyber-criminals in this regard is intermittent encryption. Instead of encrypting the entire file contents, intermittent encryption enables the ransomware to encrypt only parts of the files, and yet make the files unrecoverable without the decryption key. The trend first observed with LockFile ransomware in mid 2021 [8] have since gained wider adoption among the ransomware adversaries.

Fargo adopts the technique of intermittent encryption to speed up the encryption of all target files in the filesystem. However, it customizes its strategy based on the size of the files as a measure to balance the overheads versus benefits of the intermittent encryption. A pattern of interleaved encrypted and unencrypted regions is observed in Fargo, Mallox and TargetCompany encrypted binaries as illustrated in Figure 1. However, the size of the encrypted and unencrypted portions varies across the three variants as well as based on the size of the file being encrypted.

Figure 2 depicts the encryption algorithm adopted in Fargo. Files smaller than 10 Kilo Bytes are not encrypted. On the other hand, files of size greater than 10 Kilo Bytes and less than 50 Kilo Bytes are encrypted entirely. For file greater than 50 Kilo Bytes, Fargo divides the file into blocks. The size of the block (B in Figure 1) as well as the percentage of bytes encrypted within a block (P in Figure 1) varies with the file size. Files less than 260 Kilo Bytes are divided into blocks of equal size in the range of 4096-8192 Bytes, and within each block the first 4096 Bytes are encrypted. Consequently, within each block, few bytes are left unencrypted. We observe that for files < 260 KB, at most 255 bytes are left unencrypted. On the other hand, files > 260 KB are divided into 10 blocks of equal size. In each block, the first 15% of the bytes are encrypted.

Difference across variants. Similar encryption strategy is observed in the Fargo.YACH2 variant of Fargo. However, another variant, namely Mallox uses a different configuration for intermittent encryption. In our analyses, we observe that Mallox divides larger files greater than 3 Mega Bytes into 100 blocks of equal size. Within each block, 30 to 40% of the bytes are encrypted. In contrast, smaller files less than 128 Kilo Bytes completely encrypted. Intermediate files were observed to be divided into 25 blocks of equal size, while encrypting more than 90% of contents in each block.

Strategy of maximum impact. As only parts of the files are encrypted, Fargo can encrypt large number of files in a shorter span of time. Thus, Fargo is able to maximize impact in a shorter time before getting detected by detection and mitigation tools. At the same time, the reduced scale of encryptions minimizes the intensity of I/O operations, and can help Fargo to be classified as light-weight process. This could be used to maintain stealth.

With portions of the files left unencrypted, research have demonstrated the feasibility of recovering files encrypted by intermittent encryption. We explore the possibility of recovery of Fargo-encrypted files in Section 5.

Geo-location sensitivity

Incorporating geo-location specific control paths in malware is a well-known technique adopted by threat actors for targeted attacks. While the modus-operandi of Fargo and its related variants have been discussed in prior works [1] [6] [3] [5], we observe geo-location specific control paths in the Fargo and Mallox variants as illustrated in Figure 3.

Fargo and Mallox ransomware check for specific language identifiers in the region format settings of the target machine to identify its geo-location. If the language pack indicates languages of Russia, Ukraine, Belarus or Kazakhstan, the malware quits immediately. Table 1 lists the language packs the malware checks for along with the associated country[11]. The ransomware functionality is invoked only if the geo-location of the target machine is not among the countries listed in Table 1 (Refer to Figure 4).

Attribution. This geo-location sensitivity (verified with language pack) suggests that the threat actors behind Fargo ransomware are likely based in Russia. Russian authorities are known to control cyber-attacks within their borders, but are tolerant towards attacks targeting outside Russia [9]. For instance, Russian authorities typically refrain from launching a cybercrime investigation against a fellow citizen unless a company or individual within the nation files an official complaint as a victim. Preventing any local affiliates from generating victims in their own jurisdictions is the simplest method for these threat actors to evade detection by domestic law enforcement agencies.

Local Propagation

Fargo and Mallox also attempt to propagate to systems in the local subnet. Before the malware gathers the files for encryption, it enumerates the reachable IP addresses in the subnet (Refer to Figure 6A), using the GetIpNetTable API. The API retrieves the IPv4 addresses in the ARP table. Following this, the malware copies itself to the Windows administrative share (e.g. C$ ) folders as seen in Figure 6B. Further, it creates a service to initiate its execution. Figure 5 illustrates the operating system logs indicating the copy.

MITRE ATT&CK Techniques

Following are the different MITRE ATT&CK techniques observed for the Fargo ransomware during our analysis (Figure 7).

Execution.

Evasion.

Privilege Escalation.

Persistence.

Discovery.

Lateral Movement.

Impact.

Possibility of Recovery

As significant portions of files are left unencrypted in intermittent encryption, research shows that data could be recovered from the unencrypted portions of the file for select file formats [10]. White-Phoenix is an open-source ransomware decryptor that supports recovery of files encrypted using the strategy of intermittent encryption. The tool is shown to decrypt files encrypted by malware such as BlackCat/ALPHV, Play, Qilin/Agenda and BianLian ransomware [10].

We observe that the encryption strategy adopted in Fargo is similar to the one of the modes followed in BlackCat [7]. Unlike BlackCat, Fargo splits the entire file into equally sized blocks, whereas BlackCat encrypts a fixed size of bytes in the beginning of the file before splitting the rest of the file into blocks. With the encryption strategy being largely similar to BlackCat, the decryption of the files encrypted by Fargo seems possible with White-Phoenix. To assess if such recovery is feasible, we evaluate White-Phoenix with three different files which was encrypted by Fargo (i) a PDF document with 5 images, (ii) the same document in word (.docx) format) and (iii) a zip file.

Table 2 summarizes the results of our experiment. With respect to the PDF file, we observe that two out of 5 images could be decrypted as seen in Figure 8. While one image could be completely recovered, the other was only partially recovered. On the other hand, White-Phoenix failed to decrypt the word document.

Further, the zip file (Test.zip of 57.9MB size) had a total of 751 files. Out of these, 724 files could be completely recovered from the Fargo encrypted Test.zip.FARGO3 file. These files were recovered from the unencrypted potions of Test.zip.FARGO3 file, and varied in size from 4KB to 3.2 MB. Recovery of files of 3.2 MB size is feasible because Fargo divides the file into 10 blocks, each of size ≈ 5.7 MB, and in each block only 15% of the bytes are encrypted. On the other hand, 20 files could not be recovered at all and these files ranged in sizes from 1.7 KB to 3.4 MB. Note that the recovery of files from Test.zip.FARGO3 also depends on the location of the compressed file inside the zip file. Finally, 7 files were partially recovered. The percentage of bytes recovered in summarized in the Table.

As observed, the recovery efficacy varied on the type of file and its contents. Images could be recovered from a pdf document, and not from the word document. For images and text-based files, partial recovery may be helpful in interpreting the data. It is to be noted that the experiment was conducted using the White-Phoenix code without any Fargo-specific configuration. The recovery could be enhanced by configuring White-Phoenix to the encryption algorithm adopted by Fargo. Nevertheless, partial recovery of files that are binary in nature such as virtual machine images may not be interpretable and usable.

Conclusion

Fargo ransomware seems to be quite active given the spate of attacks reported last year [1] [3] [5] [6]. It has been known by various names such as Mallox and TargetCompany based on the extension it gives to the files after encrypting. In this report, we delved into the strategies adopted by Fargo and its variants in terms of encryption, geo-location sensitivity and propagation. Fargo and its variants adopt the intermittent encryption strategy to accelerate encryption, to maximize impact and evade detection. However, such as strategy makes it feasible for recovery of the files encrypted by the malware using open-source tools. One such tool was explored in this report. Finally, the report presents the detailed MITRE ATT&CK analysis of the behaviour of Fargo ransomware.

References

Read More at NEC Security Blog