Severity: High

Threat Type: Ransomware & Double extortion (data exfiltration + encryption)

Observed Techniques:

• Bring Your Own Vulnerable Driver (BYOVD)–style defense impairment

• Kernel-level security control termination

• Credential theft

• Lateral movement using dual-use tools

• Pre-encryption data exfiltration

• Remote access persistence

Affected Platforms: Windows environments

Components Impacted:

• Endpoint security software (via kernel-level termination)

• Enterprise hosts and services affected by ransomware encryption

• Sensitive data repositories subject to exfiltration

Attack Chain Summary:

• Initial Access / Remote Access:

  • Reporting confirms RDP was enabled within the impacted environment, likely providing remote access for attacker operations.

  • No definitive initial access vector (e.g., phishing, vulnerability exploitation) has been publicly confirmed.

• Reconnaissance:

  • Post-access discovery was conducted using legitimate and dual-use tools, including:

    • Netscan

    • Netexec

    • MeshAgent

• These tools were leveraged to enumerate hosts, users, and network paths.

Credential Access:

• Mimikatz, often renamed (e.g., kaz.exe), was deployed to extract credentials from memory.

• Harvested credentials were used to expand access within the environment.

Data Exfiltration (Pre-Encryption):

• Sensitive data was exfiltrated prior to encryption using Rclone.

• Exfiltrated data was transferred to Wasabi cloud storage, consistent with a double-extortion strategy.

Defense Impairment (BYOVD-Style Technique):

• A malicious kernel-mode driver associated with Poortry (also tracked as Abyssworker) was introduced to impair endpoint security controls.

• The driver masqueraded as a legitimate Malwarebytes anti-exploit driver.

• A loader component referred to as Stonestop was used to install the driver and issue execution instructions.

• Kernel-level access was leveraged to terminate security processes.

Security Control Neutralization:

• Endpoint security services were forcibly terminated.

• Utilities such as KillAV were used to assist with disabling EDR, antivirus, and monitoring components.

Persistence and Remote Control:

• A modified Rustdesk remote management tool was deployed to maintain persistent access.

• The tool was disguised with WinZip branding to appear legitimate and evade detection.

Ransomware Deployment:

• Osiris ransomware was executed across selected systems.

• Files were encrypted using ECC combined with AES-128-CTR, with unique encryption keys per file.

• Encrypted files were renamed with the “.Osiris” extension.

• Critical services and applications were stopped to maximize operational disruption.

Ransom Note and Extortion:

• A ransom note named Osiris-MESSAGE.txt was dropped on impacted systems.

• Victims were notified of both file encryption and prior data exfiltration, with payment demands issued to prevent data disclosure.