Sodinokibi Ransomware 

Sodinokibi is an evasive ransomware that makes use of packing, obfuscation, local privilege escalation exploits, and network obfuscation to hide its execution and C2 traffic. The ransomware targets document files and demands a ransom to be paid via TOR. 

Exploitation 

Stages 

1. An attacker places the malware on a target host through social engineering or exploiting some other vulnerability. 
2. The ransomware is either attacker or user-triggered. Once executed, it escalates privileges, targets documents for encryption, drops a ransom note, and calls out to an external C2 server. 

Prerequisites 

The attacker must have exploited some other entry vector to gain access to the local victim host. 

Alert Logic Coverage 

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.  

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.  

Detection of this threat is provided via the Alert Logic ActiveWatch for Log Manager™ service. Log messages are produced by the vulnerable system when an exploit of this type is leveraged. An incident will be generated in the Alert Logic console if these log messages are observed.  

Recommendations for Mitigation 

The attacker must have exploited some other entry vector to gain access to the local victim host. Ensure that all software on internet-facing hosts is up-to-date.