RedEnergy Stealer Strikes at Industrial Entities
A highly sophisticated ransomware and data-stealing threat named RedEnergy has been identified, targeting energy utilities, oil, gas, telecom, and machinery sectors in Brazil and the Philippines through their LinkedIn pages.
According to a recent analysis by Zscaler researchers, this .NET malware possesses the capability to extract sensitive data by stealing information from various web browsers. It incorporates multiple modules to carry out both data theft and ransomware activities. The objective of RedEnergy is to combine data theft and encryption to maximize the damage inflicted on victims.
RedEnergy Mode of Operation
The attack begins with a FakeUpdates (also known as SocGholish) campaign, which tricks users into downloading JavaScript-based malware disguised as web browser updates.
What sets this attack apart is the use of legitimate LinkedIn pages to target victims. When users click on the website URLs, they are redirected to a fake landing page that urges them to update their web browsers by clicking on the respective icons (Google Chrome, Microsoft Edge, Mozilla Firefox, or Opera). This action leads to the download of a malicious executable file.
Once a successful breach is achieved, the malicious binary establishes persistence, performs the actual browser update, and deploys a data-stealing component capable of discreetly harvesting sensitive information. It also encrypts the stolen files, putting the victims at risk of data loss, exposure, or potential sale of their valuable data.
Zscaler has observed suspicious interactions occurring through a File Transfer Protocol (FTP) connection, suggesting that valuable data may be exfiltrated to infrastructure controlled by the threat actors.
In the final stage, RedEnergy's ransomware component proceeds to encrypt the user's data, appending the ".FACKOFF!" extension to each encrypted file, deleting existing backups, and leaving a ransom note in each folder.
To regain access to their files, victims are expected to make a payment of 0.005 BTC (approximately $151) to a cryptocurrency wallet mentioned in the ransom note. RedEnergy's ability to function as both a data stealer and ransomware marks an evolution in the cybercrime landscape.
