onyx

Executive Summary

The Onyx ransomware group, first seen in April 2022, is a medium-sophistication criminal actor primarily motivated by organizational gain through ransomware and financial gain. Notably destructive, Onyx targets multiple sectors and countries, claiming around 28 victims, with a modus operandi that includes overwriting large files with random data, rendering recovery impossible. This behavior signifies a dangerous and malicious actor in the cybercrime landscape.

Goals & Targeting

Onyx's strategic objectives are centered around achieving financial gain through ransomware campaigns. The group targets organizations in multiple sectors and countries, likely seeking to maximize their financial returns by exploiting vulnerabilities wherever they are found. Their targeting profile suggests a focus on ease of exploitation and potential payout, with no specific preference for certain sectors or geographic locations, indicating a purely opportunistic approach to their attacks.

The operational tempo and victimology of Onyx suggest a focus on exploiting vulnerabilities and weaknesses in organizations' security postures. Given the global reach of their operations, it is imperative for organizations across various sectors to be vigilant and to implement robust security measures to protect against ransomware attacks. The lack of specific sectors or countries targeted by Onyx implies a more opportunistic approach, where any organization with vulnerable systems could potentially be a target.

Key Capabilities

• Ransomware deployment
• Data overwrite and destruction
• Utilization of third-party malware builders
• Potential for social engineering and phishing

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Onyx's campaign patterns indicate a rapid operational tempo, with the group quickly exploiting vulnerabilities and demanding ransom. Their operations have been noted across multiple countries, suggesting a well-coordinated effort. Notable past operations include the compromise of approximately 28 victims, with the group's destructive approach leading to significant disruption. The group's use of the Chaos ransomware builder and their data overwrite tactic signify a dangerous and evolving threat landscape.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• Potential use of exploit kits for initial access
• C2 communication over non-standard ports
• Use of temporary or disposable email addresses for ransom demands

Recommended Actions

• Implement robust email filtering to block phishing attempts
• Regularly update and patch all software and systems
• Use anti-ransomware solutions and ensure regular backups are stored securely offline
• Conduct regular security audits and vulnerability assessments

Suggested Tags