Summary

Sodinokibi was first spotted in April 2019, a few months before the GandCrab “retirement”. It was observed to have a variety of initial access:

• Vulnerability (e.g. Oracle WebLogic Server vulnerability CVE-2019-2725)
• Spearphishing with Attachment/Link
• Drive-by Compromise
• RDP / Valid Accounts

Around March 2020, it began the same practice of using stolen files as leverage for ransom payment as well. They published over 12 GB of stolen data allegedly belonging to a company named Brooks International for not paying the ransom during this time.

No observed relations with other malwares unlike other ransomwares, may have a variety of attack flows due to the RaaS nature.

Behaviour

• Deletes Shadow Volume Copy
• Maintains persistence on the targeted machine
• Terminates processes
• Stops services

Capabilities

• File Encryption
• Disabling usage capability

Impact

• Data loss - loss of important files, documents and other data upon encryption
• Financial loss - users are asked to pay in order to decrypt files that were affected
• Information Theft

Infection Routine

Current infection flow based on available data and research regarding other variants/incidents related to Sodinokibi:

• Common Flow:

  

• More Specific/Targeted Flow: