sabbath

Executive Summary

Sabbath, also known as 54BB47h (operated by UNC2190), is a medium-sophistication ransomware group that emerged in mid-2021. Originally rebranded from Arcane ransomware, they target critical infrastructure sectors such as healthcare, education, and natural resources in the US and Canada, employing double extortion and backup destruction to maximize financial gain.

Goals & Targeting

Sabbath's strategic objectives are centered around financial gain through ransomware activities. They specifically target sectors where downtime can lead to significant disruption or harm, such as hospitals and schools, maximizing the impact of their attacks and increasing the likelihood of payment. Their focus on natural resources may reflect an interest in critical infrastructure with high recovery costs. The choice of targeting the US and Canada suggests a strategic decision based on these countries' robust cyber infrastructures and higher ransom-paying potentials.

Sabbath has positioned itself as a significant player in the ransomware landscape by exploiting vulnerabilities in critical infrastructure. The group's shift from Arcane ransomware indicates an attempt to rebrand and reestablish themselves, possibly to avoid detection or enhance their operational capabilities. Their primary focus is on double extortion—encrypting victims' data and threatening to leak it unless a ransom is paid. This strategy increases the pressure on targets topay, often leading to quicker negotiations. Additionally, Sabbath's affiliate recruitment program on Russian dark web forums has expanded their reach, enabling them to target a broader range of organizations without directly exposing themselves.

Key Capabilities

• Ransomware deployment
• Double extortion tactics
• Backup destruction techniques
• Affiliate recruitment networks
• Targeting critical infrastructure

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Sabbath has demonstrated a clear pattern of targeting critical infrastructure since their emergence in 2021. Their operations span approximately four months, with notable campaigns against hospitals, schools, and natural resource sectors. The group's use of affiliate recruitment indicates an organized business model focused on scaling their attack capabilities without direct operational involvement. This approach allows them to maintain a lower profile while increasing their attack volume and geographic reach.

IOC Patterns

• Phishing emails with macro-laced Office documents
• Ransomware encryption of specific file types (e.g., .sabbath)
• Use of dark web forums for affiliate recruitment
• C2 communication via encrypted channels
• Presence of custom ransomware binaries in compromised systems

Recommended Actions

• Implement robust email filtering to detect and block phishing attempts.
• Conduct regular, secure backups and store them offline to mitigate backup destruction risks.
• Monitor network traffic for anomalous activities indicative of lateral movement or data exfiltration.
• Educate employees on identifying potential ransomware attack vectors, such as suspicious emails.
• Segment critical infrastructure networks to limit the spread of attacks.

Suggested Tags