Blue Sky Ransomware: Fast Encryption via Multithreading
Summary: Unit 42 analyzed BlueSky ransomware, which targets Windows hosts and uses a multithreaded queue - one thread encrypting files, another enumerating local files and mounted network shares - to encrypt data faster, with code similarities to Conti v3 and an exact replica of its network search module. Samples were dropped via PowerShell scripts hosted at kmsauto[.]us, used JuicyPotato or exploits for CVE-2020-0796 and CVE-2021-1732 to escalate privileges, then encrypted files with Curve25519 and ChaCha20 and renamed them with the .bluesky extension.
Key Takeaway: The same domain, kmsauto[.]us, also hosted RedLine infostealer samples, and BlueSky's multithreaded design means it can encrypt files on victim hosts and mounted network shares at rapid speeds - so the time between initial PowerShell execution and completed encryption is short.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2020-0796CVE-2021-1732
- Related
- CVE-2020-0796: Microsoft SMBv3 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022CVE-2021-1732: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021