When cybercriminals cross paths with hacktivists, the results are nothing short of catastrophic. In a bold move, the hacktivist group Crypt Ghouls has upped the ante by targeting Russian organizations with devastating ransomware attacks. Instead of brute-forcing their way into networks, they’ve taken a more insidious route: hijacking VPN connections to gain access to internal systems. With tools like LockBit and Babuk ransomware at their disposal, Crypt Ghouls have demonstrated that even trusted third-party relationships can become Trojan horses in the modern cyber battlefield.
In this article, we’ll dive deep into how Crypt Ghouls exploited Russian VPNs, the tools they deployed, and what organizations can do to protect themselves against this rising threat. You can read more about the full analysis of their tools and tactics here, but we’ll go beyond the technical breakdown to explore the broader implications of these attacks.
Table of Contents
From VPN Hijack to Full-Blown Ransomware Attack
The Crypt Ghouls aren’t just opportunistic hackers looking for an easy payday. They’re a well-organized group with a clear strategy: exploit VPN connections from compromised contractors to gain a foothold in Russian government and business networks. The choice of VPNs as an entry point is no accident—it’s a growing trend among cybercriminals, and it’s proving to be highly effective.
In at least two confirmed attacks, Crypt Ghouls used contractor credentials to access internal systems via VPNs. By leveraging VPN services, which often go unmonitored, the group was able to move freely within the network. This method is akin to walking through the front door unnoticed, making it particularly difficult for security teams to detect the breach before the damage is done.
Once inside, Crypt Ghouls unleashed their weapon of choice: ransomware. Their preferred tools? LockBit 3.0 for Windows systems and Babuk for Linux-based environments. Both of these ransomware variants are well-known for their efficiency in encrypting files and making recovery nearly impossible without paying a hefty ransom.
The Ransomware at Play: LockBit and Babuk
When it comes to modern ransomware, LockBit 3.0 and Babuk stand out as highly advanced, lethal tools in the world of cybercrime. These aren’t just run-of-the-mill pieces of malware; they represent the cutting edge of ransomware development, combining speed, stealth, and sophistication to cause maximum damage with minimal detection.
LockBit 3.0: The Aggressive Encryptor
LockBit 3.0 has earned its reputation as one of the most feared ransomware strains on the internet. This ransomware doesn’t just encrypt files—it does so with a layered, systematic approach that makes recovery particularly challenging:
- Systematic Renaming: One of LockBit 3.0’s most unique features is its ability to rename encrypted files in a specific pattern. It doesn’t simply lock files; it renames them by cycling through every letter of the alphabet, targeting specific file extensions. For example, files that are deemed critical by the attacker might be encrypted and renamed to create a cycle of confusion for recovery efforts.
- Recycle Bin Targeting: LockBit 3.0 takes its encryption a step further by also locking files stored in the Recycle Bin, a typically overlooked location. By encrypting these files and applying random renaming techniques, the ransomware ensures that even backup or discarded files are caught in its trap. This adds another layer of difficulty for victims attempting to recover their data.
- Process Termination: To maximize the effectiveness of its attack, LockBit 3.0 is configured to terminate specific processes and services, particularly those related to data backups or security. It also disables Windows Defender and deletes event logs to erase traces of its activity, further hindering detection and recovery efforts.
Real-World Impact: The sheer complexity of LockBit’s encryption and renaming process means that even if an organization has partial backups, the time and effort required to recover their systems is painstakingly slow. This pressure often forces companies to pay the ransom to restore operations quickly, adding to LockBit’s fearsome reputation.
Babuk: The Virtual Machine Destroyer
While LockBit is primarily designed for Windows-based systems, Babuk ransomware targets Linux environments, with a particular focus on ESXi servers—a popular choice for running virtual machines. Babuk has been weaponized by Crypt Ghouls to launch devastating attacks on virtualization infrastructure, causing widespread disruption to businesses that rely on virtual environments.
- ESXi Servers as Targets: In attacks where Babuk was deployed, Crypt Ghouls used it to specifically target VMware ESXi servers. These servers often host multiple virtual machines (VMs), making them a critical backbone for companies’ operations. Babuk infiltrates these environments through SSH connections, encrypting the virtual machine disk files, including critical .vmdk files, which are vital for VM operations.
- Efficient and Stealthy Encryption: Babuk’s encryption process is efficient, focusing on large-scale disruption by locking entire VMs at once. Once these virtual machines are encrypted, it effectively grinds operations to a halt, leaving organizations unable to access key applications, databases, and even entire server environments.
Example: In an attack on an organization’s ESXi infrastructure, Babuk encrypted the VMs running their customer database, payroll systems, and communication servers. Without access to these systems, the business was forced to cease operations, highlighting how ransomware like Babuk can quickly disrupt large enterprises reliant on virtualization technology.
The Public Availability of Ransomware Tools
One of the most concerning aspects of both LockBit 3.0 and Babuk is their public availability. For example, the LockBit 3.0 builder was leaked online, making it possible for anyone with malicious intent to download, modify, and deploy the ransomware. This ease of access allows groups like Crypt Ghouls to customize these ransomware variants to suit their specific attack campaigns.
- Customization: Crypt Ghouls have demonstrated how ransomware like LockBit and Babuk can be fine-tuned to target specific systems, networks, and even operating environments. Whether it’s disabling certain security features, customizing encryption algorithms, or altering ransom demands, the flexibility offered by these tools makes them highly adaptable to different types of attacks.
Growing Concern in the Cybersecurity Community: The availability of these tools on underground forums and the dark web has raised alarms across the cybersecurity industry. With such powerful ransomware now readily available, more groups—from organized crime syndicates to opportunistic hackers—can launch highly damaging ransomware campaigns with little to no technical expertise required.
A Toolkit That Spells Trouble
So, how do Crypt Ghouls manage to hijack VPNs and deploy ransomware so effectively? The answer lies in their sophisticated toolkit, which includes a mix of well-known utilities and a few lesser-known but highly dangerous surprises. This combination allows them to infiltrate networks, maintain persistence, and execute devastating attacks with precision.
Key Tools in the Crypt Ghouls’ Arsenal
Crypt Ghouls rely on a variety of powerful tools, each serving a specific purpose in their attack chain. Here are some of the most critical tools they use:
1. Mimikatz
Mimikatz is a name that has become synonymous with credential theft. This well-known tool extracts authentication credentials from system memory, providing attackers with usernames and passwords without needing to crack any encryption. Crypt Ghouls use Mimikatz to dump login details from the critical process lsass.exe (Local Security Authority Subsystem Service), which holds sensitive credentials for authenticated users on the system. Once obtained, these credentials allow the attackers to move laterally within the network, accessing other systems with ease.
Example: By targeting the lsass.exe process, attackers can retrieve passwords in plaintext format, giving them direct access to administrator accounts or other high-privilege users within the organization.
2. XenAllPasswordPro
While less famous than Mimikatz, XenAllPasswordPro has become a signature tool of the Crypt Ghouls’ attacks. This credential-stealing utility is used to harvest a wide range of authentication data from compromised machines. The group stores this tool in obscure directories, often named *\allinone2023*, making it difficult for security teams to detect and eliminate. Once deployed, XenAllPasswordPro operates quietly in the background, gathering credentials and allowing attackers to expand their control over the network.
Example: In several attacks, Crypt Ghouls deployed XenAllPasswordPro from hidden locations such as c:\programdata\1c\allinone2023\, ensuring it remained unnoticed until the damage was done.
3. MiniDump Tool
The MiniDump Tool is another utility used to extract sensitive data. This tool creates memory dumps of critical processes like lsass.exe, which stores user credentials. By extracting the memory contents, attackers can retrieve login credentials without alerting endpoint security systems. Once they have the credentials, they can escalate privileges and spread laterally across the network, infecting other machines or gaining access to higher-level systems.
Technical Insight: Attackers use the command sekurlsa::minidump lsass.dmp to dump the memory of lsass.exe. This memory dump can then be parsed to retrieve passwords, session tokens, or even Kerberos tickets used for authentication within the network.
4. Localtonet
To maintain a persistent foothold in the victim’s network, Crypt Ghouls employ Localtonet. This tool establishes encrypted tunnels, allowing attackers to connect to the compromised system remotely without detection. Even if parts of the malware or attack infrastructure are removed, Localtonet ensures that the attacker retains access. It acts as a backdoor, giving the attackers a stealthy, reliable means of re-entering the network whenever they choose.
Example: After gaining initial access through compromised VPN credentials, Crypt Ghouls deployed Localtonet to create an encrypted communication tunnel, bypassing network firewalls and security appliances. This persistent access enabled them to return to the network even after security teams thought they had neutralized the threat.
With this arsenal of tools, Crypt Ghouls are able to hijack VPN connections, infiltrate networks, and deploy ransomware like LockBit and Babuk with precision. The combination of credential theft, memory dumping, and persistent backdoors allows them to maintain control over compromised environments, often long after the initial breach.
By understanding the tools they use, organizations can better defend against this rising threat, but it requires vigilance, proactive monitoring, and robust incident response capabilities to stay ahead of these increasingly sophisticated attacks.
How VPNs Became the Weakest Link
The use of VPN hijacking in these attacks is particularly alarming because it highlights a dangerous trend in the cybercriminal world: exploiting trusted relationships and weak points in the supply chain. Organizations often place too much trust in third-party vendors and contractors, providing them with broad, often unchecked access to internal systems through VPNs. The lack of stringent security measures and oversight on these connections leaves a gaping vulnerability that groups like Crypt Ghouls are all too eager to exploit.
When cybercriminals gain access to a network via compromised VPN credentials, they effectively bypass many conventional security defenses. VPN traffic is encrypted, which is usually a good thing—but it also means that monitoring tools designed to detect and flag malicious activity often miss these intrusions. For example, VPN connections typically blend in with legitimate traffic, making it difficult to differentiate between:
- A contractor performing routine tasks
- A hacker siphoning off sensitive data or deploying ransomware
In the case of Crypt Ghouls, hijacking VPN connections isn’t just a convenient method—it’s a core part of their attack strategy. By compromising the weakest link in the supply chain (contractors), they manage to infiltrate high-value targets like government agencies and critical industries with relative ease. Once inside the network, they use tools like Mimikatz to extract login credentials and escalate privileges. From there, they can deploy ransomware like LockBit 3.0 or Babuk, encrypting key systems and crippling entire organizations.
Common VPN Exploitation Techniques:
- Credential Phishing: Attackers send a convincing email to a contractor, prompting them to “verify” their VPN credentials. Once the credentials are obtained, the attacker gains unfettered access to the network.
- Exploiting VPN Vulnerabilities: A notorious example is the CVE-2019-11510 vulnerability in Pulse Secure VPNs, which allowed attackers to retrieve plaintext usernames and passwords from system logs. This shows that the issue is not just about weak passwords but also poor security hygiene around VPN software.
Once attackers hijack a VPN connection, their lateral movement—the ability to navigate across the network—becomes much harder to detect. They can:
- Explore the network, mapping out valuable assets
- Identify high-priority targets for ransomware deployment
- Remain under the radar, even to advanced security solutions
By the time defenders realize something is wrong, the damage is already done. This is why VPN hijacking is so effective; it transforms what should be a secure connection into a Trojan horse that smuggles attackers past firewalls and intrusion detection systems.
Key Takeaways:
- VPNs, while essential, are not immune to exploitation. Their encryption can actually mask malicious activity.
- Contractors and third-party vendors often have broad access, making them an ideal target for attackers like Crypt Ghouls.
- Organizations need enhanced oversight, stricter access controls, and real-time monitoring of VPN traffic to catch abnormal behavior before it’s too late.
By securing VPN endpoints and reducing third-party access, businesses can ensure that VPNs don’t become their weakest link in the fight against sophisticated cyber threats.
The Collaboration Between Cybercriminals
One of the most disturbing aspects of Crypt Ghouls’ activity is their collaboration with other cybercriminal groups. It’s not just about sharing tools; it’s about sharing intelligence and resources. The infrastructure used by Crypt Ghouls often overlaps with other known groups, such as MorLock and Twelve.
For example, both Crypt Ghouls and MorLock use the XenAllPasswordPro tool, along with other shared utilities like AnyDesk and Localtonet. The groups also use the same VPN services, such as Surfshark, to mask their activity, making it increasingly difficult for security teams to attribute attacks to a specific group.
This kind of collaboration is a worrying trend. It shows that cybercriminals are learning from each other, sharing resources, and adapting their tactics to outsmart defenders. In the world of cybercrime, collaboration has become a force multiplier, allowing smaller groups to punch well above their weight.
What Organizations Can Learn
The attacks orchestrated by Crypt Ghouls are a stark reminder that even the most trusted systems can be vulnerable if not properly secured. For businesses and security teams, the key takeaway is that cyber defense must be proactive, multi-layered, and continuously evolving. So how can organizations protect themselves against such sophisticated and well-coordinated attacks?
Below are several practical defense strategies that can significantly reduce the risk of falling victim to these types of attacks.
Practical Defense Strategies
1. Secure Your VPN Connections
It might seem like common sense, but securing your VPN connections is often overlooked, and this is where attackers find their inroads. To strengthen VPN security:
- Use Multi-Factor Authentication (MFA): Enforce MFA on all VPN logins to ensure that a stolen username and password alone aren’t enough to gain access.
- Audit VPN Access Logs: Regularly monitor and review VPN access logs to spot any unusual activity. Suspicious logins from unexpected locations or times can be early indicators of a breach.
- Regular Patching and Updates: Ensure your VPN software is up to date and protected from known vulnerabilities, like the CVE-2019-11510 flaw in Pulse Secure VPNs, which allowed attackers to steal credentials from log files.
Example: By enforcing MFA and auditing login attempts, an organization can block attackers even if the credentials are compromised, as they would need the additional authentication factor to gain access.
2. Implement Zero Trust Policies
Gone are the days when systems inside the network perimeter could be trusted. A Zero Trust architecture demands that no user or device—inside or outside the network—is trusted by default. Instead, all requests for access must be continuously authenticated, authorized, and encrypted.
- Continuous Verification: Continuously verify the identity of users and devices, even after they are inside the network.
- Least Privilege Access: Limit user access strictly to the resources needed for their job. This reduces the potential damage an attacker can inflict if they gain unauthorized access.
Technical Insight: Zero Trust goes beyond identity verification—it also requires micro-segmentation to isolate sensitive resources. For example, instead of a flat network, where every device can communicate freely, a segmented network restricts communication between different parts.
3. Limit Contractor Access
Third-party contractors often have more access than they actually need, and attackers like Crypt Ghouls are exploiting this vulnerability. To mitigate this risk:
- Granular Access Controls: Contractors should only be given access to the systems and data necessary for their role, using the principle of least privilege.
- Review Access Regularly: Set up automated workflows to regularly review contractor access rights. If a contractor no longer needs access or has completed their task, revoke their credentials immediately.
Example: Implementing role-based access controls (RBAC) can limit what contractors can access within your network. An external IT vendor might have access to certain diagnostic tools but won’t be able to touch core business systems or sensitive data.
4. Network Segmentation
Network segmentation ensures that if one part of your network is compromised, the attacker can’t move freely across the entire infrastructure. This compartmentalization can limit the damage caused by lateral movement within your network.
- Create Secure Zones: Segment critical assets into isolated zones with strict access controls. For instance, servers running customer databases should not be directly accessible from user workstations.
- Internal Firewalls: Use internal firewalls and access control lists (ACLs) to further enforce segmentation between network zones.
Example: If attackers breach a contractor’s workstation, proper network segmentation will prevent them from accessing sensitive resources like your finance servers or databases, which would be in separate, secured segments of the network.
5. Monitor for Lateral Movement
Once inside a network, attackers like Crypt Ghouls often attempt lateral movement—hopping from one system to another to escalate privileges or gain broader access. To detect this behavior early, you need advanced monitoring tools.
- Behavioral Analytics: Use security tools that employ behavioral analytics to identify abnormal activity, such as unusual login times, unexpected file access, or abnormal network traffic patterns.
- Endpoint Detection and Response (EDR): Deploy EDR solutions that continuously monitor endpoints and provide real-time visibility into potential threats. These tools can alert you to lateral movement attempts and other suspicious activity.
Technical Insight: Tools like Microsoft’s Advanced Threat Analytics (ATA) or similar solutions can detect lateral movement by identifying credential abuse, unusual login patterns, or attempts to access sensitive parts of the network without proper authorization.
The Key to Resilience: Proactive and Layered Defense
The reality is that no single solution will protect an organization from the highly coordinated attacks seen in cases like Crypt Ghouls. Instead, organizations need to adopt a layered security approach that combines these strategies to form a resilient defense.
This involves continuously assessing your security posture, training employees to recognize phishing attacks, regularly updating your systems, and having a robust incident response plan in place to act swiftly when something goes wrong. Attackers will continue to evolve, and so must your defenses.
FAQs
What is the difference between hacktivism and traditional cybercrime?
Hacktivism involves the use of hacking techniques to promote political, social, or ideological causes, often targeting governments, corporations, or organizations perceived as adversaries to those causes. Unlike traditional cybercrime, which is typically financially motivated, hacktivism is driven by a desire to influence public opinion, expose wrongdoing, or disrupt operations in protest. Hacktivist groups like Crypt Ghouls may use similar tools as cybercriminals, such as ransomware, but their motives are often more political or ideological in nature.
How do cybercriminals gain access to VPN credentials?
Cybercriminals often gain access to VPN credentials through phishing attacks, social engineering, or by exploiting vulnerabilities in the target’s network infrastructure. In some cases, attackers may also purchase stolen credentials from underground marketplaces or gain access through weak or reused passwords. Once they have valid VPN credentials, they can move undetected within the network, making it easier to launch attacks like those carried out by Crypt Ghouls.
Why are ransomware attacks so difficult to recover from?
Ransomware attacks are notoriously difficult to recover from because they typically involve encrypting critical files and systems, making them inaccessible to the organization. Without decryption keys (which are usually provided only if a ransom is paid), it can be nearly impossible to restore the data. Additionally, sophisticated ransomware strains like LockBit 3.0 and Babuk employ advanced encryption methods and, in some cases, rename files to make decryption even more complex. Recovery from such an attack often requires a complete overhaul of the infected systems, data backups, or paying the ransom—none of which are ideal solutions.
What industries are most vulnerable to VPN-based ransomware attacks?
Industries that rely heavily on third-party vendors and contractors, such as manufacturing, healthcare, energy, and government sectors, are particularly vulnerable to VPN-based ransomware attacks. These organizations often grant extensive access to their networks through VPNs, and any compromise in the security of these connections can lead to disastrous consequences. The widespread use of VPNs in these industries creates a large attack surface for cybercriminals.
Can using a paid VPN service like Surfshark prevent these kinds of attacks?
While using a paid VPN service like Surfshark can add a layer of security by encrypting internet traffic and hiding IP addresses, it does not inherently prevent cyberattacks. VPN services protect data in transit, but they cannot protect against phishing attempts, compromised credentials, or attacks that leverage vulnerabilities within a system. Proper security protocols, such as multi-factor authentication (MFA) and regular monitoring, are essential for safeguarding VPN connections against attacks like those executed by Crypt Ghouls.
How does lateral movement in a network contribute to the spread of ransomware?
Lateral movement refers to the technique used by attackers to move through a network after gaining initial access. By exploiting vulnerabilities or compromised credentials, attackers can move from one system to another, gaining higher privileges as they progress. This allows ransomware like LockBit and Babuk to spread throughout an organization’s network, infecting more devices and making the overall recovery process significantly more challenging.
Why are ransomware variants like LockBit and Babuk particularly favored by attackers?
LockBit and Babuk ransomware variants are favored by attackers due to their high level of efficiency, customization, and availability. Both types of ransomware are highly adaptable, allowing attackers to modify them to target specific operating systems or environments. Furthermore, the public availability of their source code makes it easy for cybercriminals to adopt and tailor these tools to their needs, while their encryption techniques make decryption extremely difficult without the attacker’s key. This combination of flexibility and potency makes them particularly attractive to groups like Crypt Ghouls.
What role does encryption play in ransomware attacks, and can it be defeated?
Encryption is the cornerstone of ransomware attacks, as it is used to lock victims out of their data. In most ransomware attacks, files are encrypted using algorithms that make the data unreadable without a decryption key. While theoretically possible to defeat encryption using brute force methods, in practice, it is nearly impossible due to the complexity and time required. The only feasible recovery options are restoring from backups, paying the ransom (which is highly discouraged), or attempting decryption with tools, if available for certain ransomware variants. However, tools for defeating strong encryption are rare and typically ineffective against modern ransomware like LockBit and Babuk.
How can organizations prepare for the growing threat of hacktivist ransomware attacks?
Organizations can prepare for hacktivist ransomware attacks by adopting a multi-layered cybersecurity approach that includes implementing Zero Trust Architecture, enforcing strict access controls, conducting regular security audits, and ensuring robust incident response plans are in place. Additionally, organizations should invest in advanced threat detection systems that can identify lateral movement and unusual behavior in the network, which may indicate the early stages of an attack. Employee training on phishing and social engineering techniques is also crucial to reduce the likelihood of credential compromise.
Conclusion: The Growing Threat of Hacktivist Ransomware
Hacktivists like Crypt Ghouls are rewriting the rules of cyber warfare. Their ability to hijack VPNs and deploy ransomware like LockBit and Babuk underscores the vulnerabilities that many organizations face today. As businesses continue to rely on third-party contractors and VPN connections, the need for robust cybersecurity measures has never been greater.
The Crypt Ghouls may be a sign of what’s to come—a new breed of cybercriminal that thrives on collaboration and innovation. But with the right defenses in place, organizations can stand a fighting chance against these modern-day digital marauders.
