Ransomware Threat Assessments: A Companion to the 2021 Unit 42 Ransomware Threat Report

This post is also available in: 日本語 (Japanese)

Threat Assessment: Phobos Ransomware

Executive Summary

Phobos is a relatively basic and prolific ransomware family first publicly identified in December 2018. Because of its basic design and implementation, Phobos has been popular among threat actors. Phobos uses well-established infection vectors, such as hacked, sold, insecure or otherwise vulnerable Remote Desktop Protocol (RDP) connections or malicious attachments in phishing emails. Phobos is very similar to another ransomware family, Dharma, of which Phobos is considered a variant. In addition to the code similarities it shares with Dharma, Phobos is in part likely distributed by the same group of actors that distributed Dharma.

Phobos Ransomware Overview

While Phobos is relatively basic in its technical functionality, there are some notable functions that make Phobos interesting. While Phobos’ abuse elevation techniques do not directly include a User Account Control (UAC) bypass, a UAC bypass confirmation does routinely pop up.

Upon accepting the popup and when the encryption processes using an AES-256 key are completed, .HTA and .TXT ransom notes are displayed on the infected endpoint with a filename of info[.]txt. Phobos continues to run in the background, encoding new files the code is instructed to encrypt.

Phobos attempts to ransom all local and network shares connected to the infected host. Each infected file is encrypted with an individual key and the encrypted files have an extension of .acute. Phobos’ persistence mechanisms include installing itself in %APPDATA%, adding registry keys to autostart to ensure the malware process is persistent after a reboot. One interesting part of its functionality is the different file encoding technique used for large files. Phobos will only encrypt specific portions of large files, which reduces the amount of time it takes to encrypt the large files.

Phobos has served as the foundation for later variants, such as Eking ransomware, which was discovered in October 2020.

Phobos is most often sold in underground ransomware-as-a-service (RaaS) offerings. Phobos has historically targeted organizations of varying sizes, but in some isolated instances, Phobos has infected individuals. The total victim count of Phobos remains currently unknown.

Phobos and Dharma share several actor and code similarities. Both families share the same ransom note post-infection. Additionally, initial correspondence from the victim to both actors is the same. These shared features, along with coding similarities that Dharma and Phobos have, suggest that this malware is being developed by the same actor.

However, code differences, particularly in the file structure, define it as a variant. Specifically, Phobos has some notable differences, namely in adding in modular configuration support and providing functionality to manually encrypt folders of interest.

The average ransom payment in 2020 for Phobos was $13,955. Palo Alto Networks observed attacks on victims in the finance, education, manufacturing, professional and legal services, insurance, high tech, construction and engineering, healthcare and energy sectors. Similar to Dharma, the threat actors focus on small to medium-sized businesses. Phobos victims were located in the U.S., Portugal, Brazil, Seychelles, Romania, Indonesia, Germany and Japan.

More information on Phobos victimology can be found in the 2021 Unit 42 Ransomware Threat Report.

Courses of Action

This section documents relevant tactics, techniques and procedures (TTPs) used with Phobos and maps them directly to Palo Alto Networks product(s) and service(s). It also further instructs customers on how to ensure their devices are configured correctly.

^{Table 1. Courses of Action for Phobos ransomware.
†These capabilities are part of the NGFW security subscriptions service.}

Conclusion

Phobos is much like that of other ransomware families witnessed and analyzed by Unit 42. Capitalizing on the ease of use typical to RaaS, the actors distributing Phobos can often vary widely. Malware author and code-reuse similarities are common among Phobos ransomware families and represent an evolving threat ecosystem that thrives on sharing and common RaaS affiliate models enabling a ransomware actor to capitalize on minimal time investment.

Palo Alto Networks detects and prevents Phobos in the following ways:

• WildFire: All known samples are identified as malware.
• Cortex XDR with:
  • Indicators for Phobos.
  • Anti-Ransomware Module to detect Phobos encryption behaviors.
  • Local Analysis detection to detect Phobos binaries.
• Next-Generation Firewalls: DNS Signatures detect the known command and control (C2) domains, which are also categorized as malware in URL Filtering.
• AutoFocus: Tracking related activity using the Phobos tag.

Additionally, Indicators of Compromise (IoCs) associated with Phobos are available on GitHub, and have been published to the Unit 42 TAXII feed.

Additional Resources

• A deep dive into Phobos ransomware
• Phobos Ransomware Recovery, Payment & Decryption Statistics

Continue Reading: Dharma

Back to Top