New MegaCortex Ransomware targets enterprise networks

Experts at security firm Sophos discovered a new strain of ransomware dubbed MegaCortex that is targeting corporate networks.

Security experts at Sophos discovered a new piece of ransomware dubbed MegaCortex that is targeting corporate networks.

MegaCortex attacks were already reported in the United States, Italy, Canada, France, the Netherlands, and Ireland.

“A new ransomware that calls itself MegaCortex got a jolt of life on Wednesday as we detected a spike in the number of attacks against Sophos customers around the world, including in Italy, the United States, Canada, the Netherlands, Ireland, and France. The attackers delivering this new malware campaign employed sophisticated techiques in the attempt to infect victims.” reads a blog post published by Sophos.

“The convoluted infection methodology MegaCortex employs leverages both automated and manual components, and appears to involve a high amount of automation to infect a greater number of victims.”

MegaCortex was first spotted in January when a sample of the ransomware was uploaded on the online scanning service VirusTotal.

Experts noticed a spike in the number of attacks last week when detected and halted 47 attacks (Since January the overall number of attack based on MegaCortex is 76).

At the time of the report is still unclear the attack chain, anyway, researchers found a correlation between the MegaCortex attacks and the presence in the same network of both Emotet and Qbot (aka Qakbot) malware.

“Right now, we can’t say for certain whether the MegaCortex attacks are being aided and abetted by the Emotet malware, but so far in our investigation (which is still ongoing as this post goes live), there seems to be a correlation between the MegaCortex attacks and the presence on the same network of both Emotet and Qbot (aka Qakbot) malware.” continues the report.

Some of the victims of the ransomware reported they had the domain controllers compromised, this could be a first step of the attack.

Then crooks leverage on Cobalt Strike script that opens a Meterpreter reverse shell into the target network.

The access to the compromised domain controller (DC) allows the attackers to issue commands. The Domain Controller uses WMI to push the malware, a copy of PsExec renamed rstwg.exe, and a batch file to the machines on the machine reachable in the same network and then runs the batch file remotely via PsExec.

The batch file includes a long list of commands used by the attackers to kill 44 processes, issue stop commands to 189 different services, and switch the Startup Type for 194 different services to Disabled, which prevents them from starting up again.

Then the malicious code will execute the main malware file called winnit.exe.

“This command invokes winnit.exe to drop and execute a DLL payload with an eight-random-alphabetic character filename that performs the hostile encryption.” reads the analysis published by Sophos. “There are also indications the attackers use other batch files, named with the numbers 1.bat through 6.bat, that are being used to issue commands to distribute the winnit.exe and the “trigger” batch file around the victim’s network. “

The MegaCortex ransomware leaves a ransom note on the root of the victim’s hard drive.

The Megacortex ransomware generates a file with a .tsv file extension and the same eight-random-letter filenameas the malicious DLL and leaves it to the hard drive.

The victims have to submit this file with their request to pay the ransom to the attackers via two free email addresses.

Experts pointed out that the ransom note doesn’t mention a ransom price the crooks are demanding, instead they offer the victims “a consultation on how to improve your companies (sic) cyber security” and “a guarantee that your company will never be inconvenienced by us.”

“The softwares price will include a guarantee that your company will never be inconvenienced by us. You will also receive a consultation on how to improve your companies cyber security.”

Further technical details, including Indicators of Compromise (IoCs), are reported in the analysis published by Sophos.

Pierluigi Paganini

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2022

We are in our 10th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.


10th Anniversary Exclusive Top 100 CISO Conference & Innovators Showcase