xinglocker

Executive Summary

XingLocker is a medium-sophistication ransomware group operating under a franchise-style RaaS model, using customized MountLocker payloads for financial gain. First seen in April 2021, they target organizations for ransom, leveraging IcedID for initial access and Windows Active Directory APIs for lateral movement. Their primary motivation is organizational gain through financial extortion.

Goals & Targeting

XingLocker's strategic objectives are centered around achieving financial gain through ransomware extortions, targeting organizations that are likely to pay significant ransoms to restore critical data and services. Their targeting profile suggests a focus on sectors and countries with high-value targets, aiming to maximize potential payouts. Typical victims include organizations with critical data and those who are likely to succumb to ransom demands to minimize downtime and reputational damage.

The operational tempo and tactics employed by XingLocker highlight the evolving nature of ransomware threats. By leveraging existing malware strains like IcedID and combining them with customized payloads and lateral movement techniques, groups like XingLocker underscore the complexities faced by defenders. The use of Windows Active Directory APIs for lateral movement, in particular, emphasizes the importance of robust network segmentation and access control measures to mitigate the spread of such threats.

Key Capabilities

• Customized ransomware payloads
• Lateral movement within networks
• Use of IcedID for initial access
• Windows Active Directory API exploitation
• Franchise-style RaaS operations

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

XingLocker's campaign patterns indicate a focus on rapid initial access and lateral movement to compromise high-value targets, with the goal of extorting significant ransoms. Their operational tempo is characterized by the use of existing malware strains and customized payloads, suggesting a modular and adaptable approach to their operations. Notable past operations include the targeting of at least 21 organizations, with a temporal spread between April and October 2021, indicating a consistent and evolving threat posture.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• Use of IcedID for initial access
• C2 over DNS using fast-flux
• Staging infrastructure on bulletproof hosting
• Windows Active Directory API exploitation

Recommended Actions

• Implement robust email filtering and employee education on spear-phishing
• Enforce strict network segmentation and access controls
• Regularly update and patch Windows Active Directory APIs
• Deploy advanced threat detection and response tools
• Develop and regularly test ransomware response plans

Suggested Tags