entropy

Executive Summary

Entropy is a ransomware threat actor first observed in early 2022, linked to the Dridex banking Trojan. The group uses custom packers for their malware and has targeted organizations globally for financial gain through ransom demands.

Goals & Targeting

Entropy's strategic focus is on generating direct financial profit through ransomware campaigns. The group targets organizations across multiple sectors, leveraging Dridex to gain initial access. Their victims are typically chosen based on high-value data or assets that would maximize the potential for payout during a ransom event. There is no specific sector or geographic targeting observed thus far.

Entropy ransomware emerged in 2022 as part of a sophisticated attack campaign that combinedDridex infections with ransomware deployment. This actor employs a custom packer, which was similar to early Dridex samples. The group's primary strategy involves compromising systems through infection chains involving well-known malware like Dridex, suggesting a collaborative or integrated approach to attacks. While primarily focused on financial gain, Entropy demonstrate a level of technical expertise and operational capability that places them in the medium-sophistication category among cybercriminal threat actors.

Key Capabilities

• Ransomware deployment with custom packers
• Use of Dridex banking Trojan in infection chains
• sophisticated persistence mechanisms
• Lateral movement and data exfiltration techniques
• Spear-phishing campaigns with malicious payloads

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Entropy's campaigns exhibit a clear pattern of integrating Dridex infections to facilitate ransomware deployment. The group targets organizations globally, suggesting an opportunistic approach rather than sector-specific focus. Initial infection vectors include phishing emails and malicious scripts. Notable past operations have involved high-profile victims in multiple industries, with a focus on maximizing payout potential through targeted encryption.

IOC Patterns

• Spear-phishing emails with malicious attachments
• Script-based malware delivery
• Dridex-related indicators of compromise (IoCs)
• Custom packer signatures in executable files
• Ransomware payload deployment after initial infection

Recommended Actions

• Enhance email filtering to detect spear-phishing attempts
• Monitor for unusual script activity and process execution
• Implement endpoint detection solutions focusing on custom packer and Dridex-related patterns
• Segment network access to limit lateral movement potential
• Conduct regular training sessions on phishing awareness

Suggested Tags