New White Rabbit ransomware linked to FIN8 hacking group

White Rabbit looking down a rabbit hole

A new ransomware family called 'White Rabbit' appeared in the wild recently, and according to recent research findings, could be a side-operation of the FIN8 hacking group.

FIN8 is a financially motivated actor who has been spotted targeting financial organizations for several years, primarily by deploying POS malware that can steal credit card details.

A simple tool to deliver double-extortion

The first public mention of the White Rabbit ransomware was in a tweet by ransomware expert Michael Gillespie, seeking a sample of the malware.

#Ransomware Hunt: "White Rabbit" with extension ".scrypt", drops note for each encrypted file with ".scrypt.txt" with victim-specific information: https://t.co/ZjVay8A3Ch
"Follow the White Rabbit..." pic.twitter.com/lhzHi5t1KK
— Michael Gillespie (@demonslay335) December 14, 2021

In a new report by Trend Micro, researchers analyze a sample of the White Rabbit ransomware obtained during an attack on a US bank in December 2021.

The ransomware executable is a small payload, weighing in at 100 KB file, and requires a password to be entered on command line execution to decrypt the malicious payload.

A password to execute the malicious payload has been used previously by other ransomware operations, including Egregor, MegaCortex, and SamSam.

Once executed with the correct password, the ransomware will scan all folders on the device and encrypt targeted files, creating ransom notes for each file it encrypts.

For example, a file named test.txt would be encrypted as test.txt.scrypt, and a ransom note would be created named test.txt.scrypt.txt.

While encrypting a device, removable and network drives are also targeted, with Windows system folders excluded from encryption to prevent rendering the operating system unusable.

The ransom note informs the victim that their files had been exfiltrated and threatens to publish and/or sell the stolen data if the demands are not met.

**White Rabbit ransom note**
*Source: Trend Micro*

The deadline for the victim to pay a ransom is set to four days, after which the actors threaten to send the stolen data to data protection authorities, leading to data breach GDPR penalties.

The evidence of the stolen files is uploaded to services such as 'paste[.]com' and 'file[.]io,' while the victim is offered a live chat communication channel with the actors on a Tor negotiation site.

The Tor site includes a 'Main page,' used to display proof of stolen data, and a Chat section where the victim can communicate with the threat actors and negotiate a ransom demand, as shown below.

Links to FIN8

As noted in the Trend Micro report, evidence that connects FIN8 and 'White Rabbit' is found in the ransomware's deployment stage.

More specifically, the novel ransomware uses a never-before-seen version of Badhatch (aka "Sardonic"), a backdoor associated with FIN8.

Typically, these actors keep their custom backdoors to themselves and continue to develop them privately.

This finding is also confirmed by a different report on the same ransomware family undertaken by Lodestone researchers.

They too found Badhatch in 'White Rabbit' attacks, while they also noticed PowerShell artifacts similar to FIN8-associated activity from last summer.

As the Lodestone report concludes: "Lodestone identified a number of TTPs suggesting that White Rabbit, if operating independently of FIN8, has a close relationship with the more established threat group or is mimicking them."

For now, White Rabbit has limited itself to only targeting a few entities but is considered an emerging threat that could turn into a severe menace to companies in the future.

At this point, it can be contained by taking standard anti-ransomware measures like the following:

Deploy cross-layered detection and response solutions.
Create an incident response playbook for attack prevention and recovery.
Conduct ransomware attack simulations to identify gaps and evaluate performance.
Perform backups, test backups, verify backups, and keep offline backups.

Results for “"side-operation"”

New White Rabbit ransomware linked to FIN8 hacking group