mortar

Executive Summary

Mortar is a financially‑motivated ransomware group that combines stealthy initial access via Office add‑ins and phishing with an espionage‑grade backdoor (BRICKSTORM) and a custom ransomware engine. The actors exploit cloud storage, supply‑chain vulnerabilities, and credential theft to exfiltrate data before encrypting victims, leveraging double‑extortion tactics to maximize revenue.

Goals & Targeting

Mortar’s strategic objective is to extract maximum financial value through ransomware while extracting data for dual extortion and potentially for longer‑term espionage. The group pursues a wide target spectrum with no clear sector bias, focusing instead on organizations offering high revenue potential or rich data assets. Through stealthy initial access techniques (phishing via Office add‑ins), rapid lateral movement, and persistent backdoors, Mortar maintains prolonged presence enabling both immediate ransom demands and delayed intel exploitation. By leveraging cloud services (OneDrive, Azure AD, Okta) they seek to exfiltrate data with minimal network visibility. Their use of custom ransomware coupled with supply‑chain attacks signals an intent to evolve defensively against patching cycles and detection systems while capitalizing on privileged access. In sum, Mortar combines short‑term ransom pressure with long‑term data extraction missions to satisfy financial motives while sustaining espionage capabilities.

Key Capabilities

• Stealth initial access via malicious Office add‑ins
• Phishing campaigns using attachments and IABs
• Supply‑chain infection for backdoor deployment
• Backdoor execution using BRICKSTORM with SOCKS proxy
• Credential harvesting (OutSteel, GCollection, DWP)
• Data exfiltration through native OS APIs or cloud connectors
• Double‑extortion ransomware deployment - MORTAR, BlackSuit, BlackByte variants
• Rust/Go based encryption engines with RSA keys
• Mobile malware delivery (Pineflower) for surveillance
• Living‑off‑the‑Land execution via PowerShell and Windows binaries
• RDP persistence and lateral movement
• Cobalt Strike utilization for post‑exploitation
• Remote desktop tools (AnyDesk, RDP) for persistence
• Defensive evasion: anti‑EDR, MFA bypass, keylogging & screen capture

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Mortar campaigns typically follow a rapid, double‑extortion pattern: spearphishing initiates compromise; the loader places BRICKSTORM for persistence and data theft; ransomware is then deployed on a wide range of systems—from Windows workstations to Linux servers and ESXi hosts—often in under an hour. The actor shares infrastructure with other cybercriminal RaaS groups (e.g., Akira, LockBit) through mutual backdoor libraries, suggesting operational collaboration or shared codebases. Victim profiles skew toward organizations with remote workforces leveraging cloud services, offering abundant credential vaults and backup systems that are easy to encrypt. Attackers often exploit zero‑day vulnerabilities (ProxyShell/Exchange, Log4Shell) or credential stuffing when initial access fails. The group employs a mix of waterhole sites, typo‑scattered domains, and malicious URLs bundled in phishing emails. Defensive posture reveals that incidents peak during major public events or fiscal closures, aligning with higher willingness to pay. Notable operations include the deployment of Rhysida ransomware across multiple sectors and a coordinated exfiltration followed by a Wiper payload aimed at Israeli infrastructure.

IOC Patterns

• Spearphishing emails with malicious attachments or links
• Phishing campaigns using IABs, typo‑squatted domains, and phishing kits
• Malicious URLs leading to credential harvesting sites
• Adversary-controlled domains for C2 traffic (SMTP/IMAP)
• Backdoor binaries featuring SOCKS proxy functionality
• Credential dumping tools like Mimikatz
• Exfiltration indicators (data staging directories), unusual network traffic to cloud storage
• Encrypted or obfuscated PowerShell scripts
• Changes in registry or system configuration used for persistence
• RDP session logs indicating lateral movement

Recommended Actions

• Implement MFA and enforce conditional access policies on all remote services and cloud identities.
• Deploy Office 365 Defender rules that block or sandbox new Office add‑ins, especially from untrusted origins.
• Enable EDR with detection of stealth shellcode loaders and backdoor behavior such as SOCKS proxy use.
• Monitor OneDrive/Office 365 activity for large outbound transfers or anomalous patterns. Maintain up‑to‑date backups in immutable media and test restore procedures before patching ransomware variants. Block known command‑and‑control domains/IPs (including Brickstorm, GootLoader, Cobalt Strike beacon traffic) via threat‑intel feeds. Apply strict application whitelisting for PowerShell and Windows binaries; monitor for lateral RDP use or AnyDesk connections. Conduct user awareness campaigns focused on spearphishing, especially phishing attachments, IABs, and link-based malware. Patch systems promptly to mitigate zero‑day exploitation vectors such as Exchange ProxyShell and Log4Shell. Detect and remove malicious Android payloads (Pineflower) via mobile threat defense solutions. Log and investigate any changes in registry or system services that could indicate backdoor persistence or anti‑malware termination.

Suggested Tags