Rook ransomware is yet one more spawn of the leaked Babuk code

A brand new ransomware operation named Rook has appeared lately on the cyber-crime area, declaring a determined must make “some huge cash” by breaching company networks and encrypting gadgets.

Though the introductory statements on their information leak portal have been marginally humorous, the primary sufferer bulletins on the location have made it clear that Rook isn’t enjoying video games.

Researchers at SentinelLabs have taken a deep dive into the brand new pressure, revealing its technical particulars, an infection chain, and the way it overlaps with the Babuk ransomware.

An infection course of

The Rook ransomware payload is normally delivered through Cobalt Strike, with phishing emails and shady torrent downloads being reported because the preliminary an infection vector.

The payloads are full of UPX or different crypters to assist evade detection. When executed, the ransomware makes an attempt to terminate processes associated to safety instruments or something that might interrupt the encryption.

“Curiously, we see the kph.sys driver from Course of Hacker come into play in course of termination in some circumstances however not others,” SentinelLabs explains in its report.

“This probably displays the attacker’s must leverage the motive force to disable sure native safety options on particular engagements.”

Rook additionally makes use of vssadmin.exe to delete quantity shadow copies, a typical tactic utilized by ransomware operations to forestall shadow volumes from being used to get better recordsdata.

Analysts have discovered no persistence mechanisms, so Rook will encrypt the recordsdata, append the “.Rook” extension after which delete itself from the compromised system.

Based mostly on Babuk

SentinelLabs has discovered quite a few code similarities between Rook and Babuk, a defunct RaaS that had its full supply code leaked on a Russian-speaking discussion board in September 2021.

For instance, Rook makes use of the identical API calls to retrieve the identify and standing of every operating service and the identical features to terminate them.

Additionally, the checklist of processes and Home windows providers which can be stopped are the identical for each ransomware.

This contains the Steam gaming platform, the Microsoft Workplace and Outlook electronic mail consumer, and Mozilla Firefox and Thunderbird.

Different similarities embody how the encryptor deletes shadow quantity copies, makes use of the Home windows Restart Supervisor API, and enumerates native drives.

Because of these code similarities, Sentinel One believes that Rook is predicated on the leaked supply code for the Babuk Ransomware operation.

Is Rook a severe risk?

Whereas it’s too quickly to inform how subtle Rook’s assaults are, the implications of an an infection are nonetheless extreme, resulting in encrypted and stolen information.

The Rook information leak website at present accommodates two victims, a financial institution and an Indian aviation and aerospace specialist.

Each have been added this month, so we’re at an early stage within the group’s actions.

If expert associates be part of the brand new RaaS, Rook might turn out to be a big risk sooner or later.