New RansomHub attack uses TDSKiller and LaZagne, disables EDR

Tags

External References

• https://www.threatdown.com/
• https://otx.alienvault.com/

Description

A recent analysis by the ThreatDown MDR team has uncovered a novel attack method employed by the RansomHub ransomware gang. The attackers are utilizing two tools: TDSSKiller, a legitimate Kaspersky rootkit removal utility, to disable endpoint detection and response (EDR) systems, and LaZagne, a credential harvesting tool. This marks the first instance of RansomHub incorporating these tools into their arsenal. The attack begins with network reconnaissance and admin group enumeration, followed by the deployment of TDSSKiller to disable security services like Malwarebytes Anti-Malware Service. Subsequently, LaZagne is used to extract stored credentials from various applications, facilitating lateral movement within the compromised network. The campaign is currently active, prompting the implementation of new detection rules and recommendations for enhanced security measures.

Date