Security researchers at The DFIR Report have uncovered the cyber activities of the Quantum ransomware gang which saw the attackers go from initial access to domain-wide ransomware.<\/p>\n
Described as one of the fastest ransomware cases, the attackers used an IcedID payload delivered via email as the initial access vector.<\/p>\n
After the initial IcedID payload was executed, almost two hours after the initial infection, the threat actors begin hands-on keyboard activity. The attackers then use Cobalt Strike and RDP to move across the network, before they use WMI and PsExec to deploy the Quantum ransomware.<\/p>\n
The attack highlights an extremely short Time-to-Ransom (TTR) of 3 hours and 44 minutes.<\/p>\n
The attackers were able to enter the network when a user endpoint was compromised by an IcedID payload contained in an ISO image.<\/p>\n
The ISO contained a DLL file (IcedID malware) and an LNK shortcut to execute it. Once the ISO file was clicked, a single file name “document” is displayed. The file is an LNK shortcut to a hidden DLL that is packaged in the ISO. When the user clicks on the LNK file, the IcedID DLL is executed.<\/p>\n