Cybersecurity researchers have detailed the actions of an preliminary entry dealer (IAB) dubbed ToyMaker that has been noticed handing over entry to double extortion ransomware gangs like CACTUS.
The IAB has been assessed with medium confidence to be a financially motivated menace actor, scanning for weak techniques and deploying a customized malware referred to as LAGTOY (aka HOLERUN).
“LAGTOY can be utilized to create reverse shells and execute instructions on contaminated endpoints,” Cisco Talos researchers Joey Chen, Asheer Malhotra, Ashley Shen, Vitor Ventura, and Brandon White mentioned.
The malware was first documented by Google-owned Mandiant in late March 2023, attributing its use to a menace actor it tracks as UNC961. The exercise cluster can also be identified by different names corresponding to Gold Melody and Prophet Spider.
The menace actor has been noticed leveraging an enormous arsenal of identified safety flaws in internet-facing functions to acquire preliminary entry, adopted by conducting reconnaissance, credential harvesting, and LAGTOY deployment inside a span of per week.
The attackers additionally open SSH connections to a distant host to obtain a forensics device referred to as Magnet RAM Seize to acquire a reminiscence dump of the machine in a possible try to collect the sufferer’s credentials.
LAGTOY is designed to contact a hard-coded command-and-control (C2) server to retrieve instructions for subsequent execution on the endpoint. It may be used to create processes and run instructions underneath specified customers with corresponding privileges, per Mandiant.
The malware can also be geared up to course of three instructions from the C2 server with a Sleep interval of 11000 milliseconds between them.
“After a lull in exercise of roughly three weeks, we noticed the CACTUS ransomware group make its approach into the sufferer enterprise utilizing credentials stolen by ToyMaker,” Talos mentioned.
“Based mostly on the comparatively brief dwell time, the dearth of information theft and the next handover to CACTUS, it’s unlikely that ToyMaker had any espionage-motivated ambitions or objectives.”
Within the incident analyzed by Talos, the CACTUS ransomware associates are mentioned to have performed reconnaissance and persistence actions of their very own previous to information exfiltration and encryption. Additionally noticed are a number of strategies to arrange long-term entry utilizing OpenSSH, AnyDesk, and eHorus Agent.
“ToyMaker is a financially-motivated preliminary entry dealer (IAB) who acquires entry to high-value organizations after which transfers that entry to secondary menace actors who often monetize the entry through double extortion and ransomware deployment,” the corporate mentioned.
