Cybersecurity researchers have detailed the actions of an preliminary entry dealer (IAB) dubbed ToyMaker that has been noticed handing over entry to double extortion ransomware gangs like CACTUS.
The IAB has been assessed with medium confidence to be a financially motivated menace actor, scanning for weak methods and deploying a customized malware known as LAGTOY (aka HOLERUN).
“LAGTOY can be utilized to create reverse shells and execute instructions on contaminated endpoints,” Cisco Talos researchers Joey Chen, Asheer Malhotra, Ashley Shen, Vitor Ventura, and Brandon White stated.
The malware was first documented by Google-owned Mandiant in late March 2023, attributing its use to a menace actor it tracks as UNC961. The exercise cluster can be recognized by different names similar to Gold Melody and Prophet Spider.
The menace actor has been noticed leveraging an enormous arsenal of recognized safety flaws in internet-facing purposes to acquire preliminary entry, adopted by conducting reconnaissance, credential harvesting, and LAGTOY deployment inside a span of per week.
The attackers additionally open SSH connections to a distant host to obtain a forensics device known as Magnet RAM Seize to acquire a reminiscence dump of the machine in a possible try to collect the sufferer’s credentials.
LAGTOY is designed to contact a hard-coded command-and-control (C2) server to retrieve instructions for subsequent execution on the endpoint. It may be used to create processes and run instructions beneath specified customers with corresponding privileges, per Mandiant.
The malware can be outfitted to course of three instructions from the C2 server with a Sleep interval of 11000 milliseconds between them.
“After a lull in exercise of roughly three weeks, we noticed the CACTUS ransomware group make its manner into the sufferer enterprise utilizing credentials stolen by ToyMaker,” Talos stated.
“Primarily based on the comparatively quick dwell time, the shortage of knowledge theft and the following handover to CACTUS, it’s unlikely that ToyMaker had any espionage-motivated ambitions or targets.”
Within the incident analyzed by Talos, the CACTUS ransomware associates are stated to have performed reconnaissance and persistence actions of their very own previous to information exfiltration and encryption. Additionally noticed are a number of strategies to arrange long-term entry utilizing OpenSSH, AnyDesk, and eHorus Agent.
“ToyMaker is a financially-motivated preliminary entry dealer (IAB) who acquires entry to high-value organizations after which transfers that entry to secondary menace actors who often monetize the entry through double extortion and ransomware deployment,” the corporate stated.
