Daixin Team Ransomware targeting multiple organizations

Analysis

On 21st October 2022, the Cybersecurity & Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) jointly issued a warning about a ransomware group (Daixin Team) targeting Healthcare sectors and businesses with ransomware carrying data extortion operations.

The threat group has been targeting organizations since June 2022, the Daixin team gain initial access through the VPN servers, then move laterally by using Remote Desktop Protocol (RDP) and Secure Shell (SSH), then the threat group gains privileged account access through credential dumping and pass the hash.

Finally, Daixin Team deploys ransomware with a ransomware note and exfiltrates data from the compromised system. To exfiltrate data the threat group uses a dedicated virtual private server.

Prevention

• Keep the system software up-to-date with security updates.
• Use phishing-resistant MFA for as many services as possible.
• Use Antivirus and EDR in all endpoints.
• Take regular backups of devices in the organization to reduce the impact of ransomware attacks.

Detection

Create rules based on known indicators of ransomware in the SIEM (Security incident event management) tool for the detection of ransomware.

MITRE ATT&CK® Techniques

Indicators of Compromise (IOCs)

References

CISA.gov