(U//FOUO) DHS Intelligence Note: Unidentified Cyber Actor Attacks State and Local Government Networks with GrandCrab Ransomware

July 22, 2018

Unidentified Cyber Actor Attacks State and Local Government Networks with GrandCrab Ransomware

Page Count: 3 pages
Date: June 4, 2018
Restriction: For Official Use Only
Originating Organization: Department of Homeland Security, Office of Intelligence and Analysis
File Type: pdf
File Size: 272,001 bytes
File Hash (SHA-256): 33D7903C899000F32FEF462130E8D9081F204EE41EB620B813A2E654F54415E5

Download File

(U//FOUO) An unidentified cyber actor in mid-March 2018 used GrandCrab Version 2 ransomware to attack a State of Connecticut municipality network and a state judicial branch network, according to DHS reporting derived from a state law enforcement official with direct and indirect access. The municipality did not pay the ransom, resulting in the encryption of multiple servers that affected some data backups and the loss of tax payment information and assessor data. The attack against the state judicial branch resulted in the infection of numerous computers, but minimal content encryption, according to the same DHS report.

(U//FOUO) The unidentified cyber actor introduced the ransomware used against the judicial branch network through a vendor server/host; the ransomware then harvested cached credentials of high-level privileged accounts, according to the same DHS report. The actor then used the credentials to access two servers on the network and propagate the malware via server message block (SMB). Connecticut state cybersecurity officials were able to block the ransomware’s communication with external infrastructure, which prevented the encryption of additional hosts and data loss, according to the same DHS report.

(U) GandCrab Malware

(U) Released in late January 2018, GandCrab, also called “GrandCrab,” is a ransomware variant distributed by exploit kits that requires communication with the ransomware’s command-and-control (C2) server to encrypt files of an infected computer, according to an online technical support site. The developers of GandCrab recently upgraded the original version after Romanian police and BitDefender mitigated infections by recovering its decryption keys, according to a separate article from the same online technical support site. As of 6 March 2018, no free decryption key is available to victims of GandCrab version 2. GandCrab uses NameCoin’s .BIT as its top-level domain (TLD); therefore, variants of the ransomware using the .BIT TLD must also use a domain name server that supports .BIT, according to the same online technical support site. Upon infection, GandCrab will attempt to query the ransomware’s C2 servers on the .BIT domain to establish communication. GandCrab will not encrypt a host’s content with the .CRAB extension if communication is not established with the C2 server, according to the same online technical support site.