The threat actor, formed in 2023, specializes in ransomware attacks targeting Russian government organizations. It encrypts and deletes victim data, exfiltrates sensitive information, and aims to inflict maximum damage on critical assets.
The threat actor likely scans IP address ranges in Russia to identify VPN servers and applications accessible from the internet that could serve as entry points into target organizations or their contractors.
Adversaries often exploit contractors’ infrastructure to gain access to their customers’ networks, using stolen credentials and RDP to move laterally and compromise sensitive systems.
The attackers deployed various web shells, primarily in PHP, to compromise web servers. These shells were used to execute commands, move files, and send emails. Many of these shells were publicly available tools and found in common locations like Bitrix folders.
Free Webinar on How to Protect Small Businesses Against Advanced Cyberthreats -> Free Registration
They exploited vCenter Server vulnerabilities (CVE-2021-21972, CVE-2021-22005) to deploy a web shell, which they then used to load the FaceFish backdoor, which injects itself into the SSH process.
It used PowerShell and net.exe to add domain accounts and groups, modify ACLs, and distribute malware through the task scheduler and group policies, gaining control over the domain infrastructure.
The attackers disguised malware and tasks under legitimate names, cleared event logs and RDP connection history, and used Cobalt Strike and PowerShell tools for C2 and payload distribution.
They also used Ngrok to create a remote access tunnel to the compromised system, configuring it to listen on port 3389, disguised as a legitimate system service to evade detection.
The adversary used various tools to explore, discover, and exploit the victim’s network and domain infrastructure by leveraging legitimate credentials to escalate privileges and modify account attributes to gain more control.
It uses self-written scripts (ps1, bat) to disable security software (Sophos) and potentially gather domain information (PowerView).
It used Task Scheduler to schedule malicious tasks that executed ransomware and wipers on all domain machines simultaneously. These tasks were triggered by group policy modifications and copied and executed the malicious files from a network share.
Various tools, such as mimikatz, reg.exe, ntdsutil.exe, and All-In-One Password Recovery Pro, were used to extract credentials from compromised systems and then leverage these credentials to move laterally within the victim’s network using RDP, PsExec, and PowerShell Remoting.
It successfully extracted sensitive victim data using Telegram’s cached data folder, compromising privacy and potentially enabling account impersonation.
LockBit 3.0 ransomware encrypts data and spreads via group policies and PowerShell scripts, terminates security software, and deletes event logs.
Using a publicly available wiper to destroy data on victim infrastructures after encrypting files, the wiper overwrote MBR, file contents, and metadata, then deleted itself and shut down the system, which was spread via PowerShell and scheduled tasks.
According to Kaspersky, Twelve is a hacktivist group focused on causing maximum damage to target organizations through data destruction and infrastructure disruption using publicly available malware tools.
Analyse AnySuspicious Links Using ANY.RUN's New Safe Browsing Tool: Try It for Free