Qilin ransomware now steals credentials from Chrome browsers

Share

By Bill Toulas, August 22, 2024 05:40 PM

The Qilin ransomware group has been using a new tactic and deploys a custom stealer to steal account credentials stored in Google Chrome browser.

The credential-harvesting techniques has been observed by the Sophos X-Ops team during incident response engagements and marks an alarming change on the ransomware scene.

Attack overview

The attack that Sophos researchers analyzed started with Qilin gaining access to a network using compromised credentials for a VPN portal that lacked multi-factor authentication (MFA).

The breach was followed by 18 days of dormancy, suggesting the possibility of Qilin buying their way into the network from an initial access broker (IAB).

Possibly, Qilin spent time mapping the network, identifying critical assets, and conducting reconnaissance.

After the first 18 days, the attackers moved laterally to a domain controller and modified Group Policy Objects (GPOs) to execute a PowerShell script (‘IPScanner.ps1’) on all machines logged into the domain network.

The script, executed by a batch script (‘logon.bat’) that was also included in the GPO, was designed to collect credentials stored in Google Chrome.

The batch script was configured to run (and trigger the PS script) every time a user logged into their machine, while stolen credentials were saved on the ‘SYSVOL’ share under the names ‘LD’ or ‘temp.log.’

Contents of the LD dump
Contents of the LD dump
Source: Sophos

After sending the files to Qilin’s command and control (C2) server, the local copies and related event logs were wiped, to conceal the malicious activity. Eventually, Qilin deployed their ransomware payload and encrypted data on the compromised machines.

Another GPO and a separate batch file (‘run.bat’) were used to download and execute the ransomware across all machines in the domain.

Qilin's ransom note
Qilin’s ransom note
Source: Sophos

Defense complexity

Qilin’s approach to target Chrome credentials creates a worrying precedent that could make protecting against ransomware attacks even more challenging.

Because the GPO applied to all machines in the domain, every device that a user logged into was subject to the credential harvesting process.

This means that the script potentially stole credentials from all machines across the company, as long as those machines were connected to the domain and had users logging into them during the period the script was active.

Such extensive credential theft could enable follow-up attacks, lead to widespread breaches across multiple platforms and services, make response efforts a lot more cumbersome, and introduce a lingering, long-lasting threat after the ransomware incident is resolved.

A successful compromise of this sort would mean that not only must defenders change all Active Directory passwords; they should also (in theory) request that end users change their passwords for dozens, potentially hundreds, of third-party sites for which the users have saved their username-password combinations in the Chrome browser. – Sophos

Organizations can mitigate this risk by imposing strict policies to forbid the storage of secrets on web browsers.

Additionally, implementing multi-factor authentication is key in protecting accounts against hijacks, even in the case of credential compromises.

Finally, implementing the principles of least privilege and segmenting the network can significantly hamper a threat actor’s ability to spread on the compromised network.

Given that Qilin is an unconstrained and multi-platform threat with links to the Scattered Spider social engineering experts, any tactical change poses a significant risk to organizations.

This story was originally featured on Bleepingcomputer.com

Author Photo

Bill Toulas

Author Bio

Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

0 0 votes
Article Rating
Subscribe
Notify of
guest

2 Comments
Inline Feedbacks
View all comments
Live Coin Watch
Live Coin Watch
1 month ago

Live Coin Watch I appreciate you sharing this blog post. Thanks Again. Cool.

businesstrick
businesstrick
28 days ago

obviously like your website but you need to test the spelling on quite a few of your posts Several of them are rife with spelling problems and I to find it very troublesome to inform the reality on the other hand Ill certainly come back again

2
0
Would love your thoughts, please comment.x
()
x