As reported on “BleepingComputer” website on 8-Sep-22:
”
Microsoft says an Iranian state-sponsored threat group it tracks as DEV-0270 (aka Nemesis Kitten) has been abusing the BitLocker Windows feature in attacks to encrypt victims’ systems.
Redmond’s threat intelligence teams found that the group is quick to exploit newly disclosed security vulnerabilities and extensively uses living-off-the-land binaries (LOLBINs) in attacks.
This aligns with Microsoft’s findings that DEV-0270 uses BitLocker, a data protection feature that provides full volume encryption on devices running Windows 10, Windows 11, or Windows Server 2016 and above.
“DEV-0270 has been seen using setup.bat commands to enable BitLocker encryption, which leads to the hosts becoming inoperable,” the Microsoft Security Threat Intelligence explained.
“For workstations, the group uses DiskCryptor, an open-source full disk encryption system for Windows that allows for the encryption of a device’s entire hard drive.”
The time to ransom (TTR) between the initial access and the ransom note being deployed on locked systems was around two days, and DEV-0270 has been observed demanding victims to pay $8,000 for decryption keys following successful attacks.
”
Read more by clicking the button below.
Typical DEV-0270 attack chain
(source: Microsoft Security Threat Intelligence Blog)
