Threat Intelligence Report October 22 - October 28 2024

APT73: Eraleign Ransomware

APT73, also known as Eraleign, marks itself as an "APT" (Advanced Persistent Threat), a designation it chose to align with notable groups like APT37. Originating as a spin-off from the LockBit group, APT73's operations mirror those of its predecessor, which is evident in its data leak site (DLS) setup. The group's hallmark is its ransomware DLS named "ERALEIGNEWS," located on the dark web and accessible via TOR, showcasing limited active operations compared to LockBit. APT73's first publicised target was TRIFECTA, a U.S.-based customer service platform focusing on Salesforce, suggesting a strategic selection of high-value targets. This group's DLS lacks the sophistication of LockBit’s, with no active mirrors and only a single victim leak displayed, pointing to its nascent stage in the ransomware arena.

The unique aspect of APT73 is its lack of public promotion and its low-key operational style, hinting at either an early stage of victimisation or a strategy to stay under the radar until a significant number of victims are secured. Their operational base reflects a systematic approach to ransomware deployment, leveraging both direct system compromise and broader strategic data leaks to exert pressure on victims.

Detailed TTPs for APT73: Eraleign Ransomware

1. Phishing and Exploitation: APT73 initiates its attacks primarily through phishing, employing tactics to exploit public-facing applications, mirroring strategies used by its progenitor, LockBit.
2. Website Cloning and Deception: Their operational websites, including "Contact Us" and instructional pages, are clones of LockBit’s, indicating shared tactics or possibly shared resources.
3. Data Leak Site Operations: The group’s data leak site "ERALEIGNEWS" on the TOR network showcases a minimalistic operational footprint with scarce victim data, reflecting a strategic or developmental approach.
4. TOR Network Anonymity: They heavily rely on the TOR network for hosting and data leaks, ensuring anonymity in their operations and complicating efforts to trace their activities.
5. Selective Targeting and Data Exfiltration: Their targeting of specific high-value sectors like customer service platforms indicates a systematic selection process for maximum impact.
6. Operational Security: The lack of public promotion and low visibility in common forums suggests a cautious operational security strategy aimed at avoiding early detection by law enforcement and cybersecurity firms.

These TTPs highlight APT73's cautious yet strategic approach to establishing its presence in the ransomware landscape.

Figure 2: Screenshot of Leak Site used by APT73

Key Characteristics of APT73:

• Emergence: Surfaced in late 2023, quickly aligning itself with strategies commonly seen in LockBit and other prominent ransomware gangs.
• Use of a TOR-Based Data Leak Site (DLS): The group's data leak site (DLS), dubbed "ERALEIGNEWS," is hosted on the TOR network, making it challenging to trace their activities. While the group lacks active mirrors for their DLS, a feature typically seen in more mature ransomware operations, they are still effective in threatening victims with public exposure of stolen data.
• Ransomware Distribution: APT73 primarily employs phishing campaigns to gain an initial foothold within an organisation. From there, they compromise systems and deploy their ransomware. Their operations are opportunistic, meaning they appear to exploit unpatched systems and security weaknesses rather than leveraging more sophisticated zero-day exploits.

Modus Operandi:

• Phishing Attacks: The primary method of attack used by APT73 is phishing, likely via email with malicious attachments or links. This is a common initial access vector for ransomware groups, allowing them to gain unauthorised entry into targeted systems.
• Data Exfiltration: One of APT73's signature moves is the exfiltration of sensitive corporate data, which is later used as leverage in their extortion campaigns. The group focuses on compromising valuable files such as legal documents, client information, financial data, and internal agreements, making their threats particularly damaging to their victims.
• Threat to Leak Data: After encrypting the victim’s systems, APT73 threatens to publish the stolen data on their TOR site (ERALEIGNEWS) if ransom demands are not met. This double extortion tactic increases the pressure on victims to pay the ransom.

Technical Observations:

• Phishing and Social Engineering: APT73 is likely leveraging spear-phishing techniques to target employees at high-value organisations. These phishing campaigns may involve malicious documents or URLs disguised as legitimate business communications.
• Double Extortion: APT73 employs a two-pronged approach where they not only encrypt files but also exfiltrate data to increase the leverage over their victims. The stolen data is then posted or threatened to be posted on their DLS "ERALEIGNEWS" if ransom demands are not met.
• Data Leak Site (DLS): "ERALEIGNEWS" appears amateurish in some ways, with no active mirrors—a sign of a group that may still be evolving. Despite this, the use of a TOR-based site offers them protection against easy shutdown by law enforcement.

Mitigation Strategies:

• Phishing Protection: Organisations must implement robust phishing defences, including email filtering, user education, and multi-factor authentication (MFA) to limit the success of credential theft through phishing.
• Data Encryption and Backup: Encrypt sensitive data both at rest and in transit. Regular, isolated backups can help mitigate the effects of a ransomware attack.
• Endpoint Detection and Response (EDR): Deploying strong endpoint monitoring solutions can help detect the early stages of intrusion or lateral movement within a network.
• Patch Management: Ensure systems are up-to-date with the latest security patches to avoid exploitation of known vulnerabilities.
• Below is a detailed MITRE ATT&CK-based kill chain for APT73, illustrating each phase of their attack process along with the relevant tactic, technique IDs, and names.
  
  

APT73 Kill Chain: