Full Report
Threat actors linked to lesser-known ransomware and malware projects now use AI tools as lures to infect unsuspecting victims with malicious payloads. [...]
Analysis Summary
# Tool/Technique: Lucky\_Gh0\$t
## Overview
Lucky\_Gh0\$t is a new ransomware strain observed being distributed by cybercriminal campaigns exploiting the current interest in AI tools. It is derived from the Yashma ransomware, which itself is based on the Chaos ransomware. It is disguised as a legitimate AI installer to trick users into execution.
## Technical Details
- Type: Malware family (Ransomware)
- Platform: Windows
- Capabilities: File encryption, system disruption, ransom communication.
- First Seen: Recently observed (Context implies recent activity exploiting AI hype).
## MITRE ATT&CK Mapping
*Note: Specific technical execution details are lacking, so mappings are inferred based on general ransomware behavior.*
- TA0011 - Command and Control (Inferred for ransom negotiation)
- T1071 - Application Layer Protocol
- TA0040 - Impact
- T1486 - Data Encrypted for Impact
## Functionality
### Core Capabilities
- File Encryption: Encrypts files smaller than 1.2GB, appending them with random four-character extensions.
- Large File Handling: Replaces files larger than 1.2GB with a same-size junk file and then deletes the original.
- Ransom Communication: Provides victims with a personal ID and directs them to use the Session secure messenger platform for ransom negotiations.
### Advanced Features
- Evading Detection: Packaged within a self-extracting archive alongside legitimate Microsoft open-source AI tools, likely as a means to evade antivirus detection.
## Indicators of Compromise
- File Hashes: [Not provided in context]
- File Names: Distributed as a fake ChatGPT installer (`ChatGPT 4.0 full version - Premium.exe`).
- Registry Keys: [Not provided in context]
- Network Indicators: Utilizes the Session messenger platform for C2/negotiation.
- Behavioral Indicators: Encrypts files and replaces larger files with junk data.
## Associated Threat Actors
- [Not explicitly named, but associated with campaigns exploiting AI hype]
## Detection Methods
- Signature-based detection: Detection based on known hashes or signatures of the payload.
- Behavioral detection: Monitoring for mass file encryption activity or the creation of files appended with random extensions.
- YARA rules if available: [Not provided in context]
## Mitigation Strategies
- Prevention measures: Only download AI tools and software from official, trusted websites, avoiding links from promoted search results or social media.
- Hardening recommendations: Maintain robust backups of all critical data.
## Related Tools/Techniques
- Based on: Yashma ransomware.
- Ancestor: Chaos ransomware.
***
# Tool/Technique: Numero Malware
## Overview
Numero is a new malware strain designed to attack Windows systems. It masquerades as an InVideo AI installer. Its primary function is to render the infected system graphically unusable without destroying or encrypting data, locking the system in a corrupted state via an infinite loop.
## Technical Details
- Type: Malware (System Sabotage/Locker)
- Platform: Windows
- Capabilities: Graphical User Interface (GUI) corruption, infinite loop execution.
- First Seen: Recently observed (Context implies recent activity exploiting AI hype).
## MITRE ATT&CK Mapping
*Note: Mappings focus on the denial of service/system hijacking aspects.*
- TA0005 - Defense Evasion (Inferred if obfuscation is used in the dropper)
- TA0003 - Persistence (Implied by the infinite loop execution)
- TA0004 - Privilege Escalation (Unknown)
- TA0010 - Impact
- T1490 - Inhibit System Recovery (Due to continuous corruption causing operational failure)
## Functionality
### Core Capabilities
- GUI Overwriting: Continuously overwrites window titles, buttons, and general content with the numeric string "1234567890".
- System Locking: Executes in an infinite loop, ensuring the system remains visually corrupted and unusable.
### Advanced Features
- Dropper Components: Delivered via a dropper containing a batch file, a VB script, and a main executable (`wintitle.exe`).
## Indicators of Compromise
- File Hashes: [Not provided in context]
- File Names: `wintitle.exe` (Executable component); associated with fake InVideo AI installer.
- Registry Keys: [Not provided in context]
- Network Indicators: [Not provided in context]
- Behavioral Indicators: Graphical interface elements being systematically replaced byte-by-byte (or string-by-string) with "1234567890."
## Associated Threat Actors
- [Not explicitly named]
## Detection Methods
- Signature-based detection: Detection based on the specific payload components (batch file, VBScript, `wintitle.exe`).
- Behavioral detection: Monitoring for processes that continuously manipulate window handles or titles in a loop.
- YARA rules if available: [Not provided in context]
## Mitigation Strategies
- Prevention measures: Exercise extreme caution when downloading installers for new or niche AI tools, sourcing only from official channels.
- Hardening recommendations: Implement controls to limit the execution of unauthorized scripts (Batch, VBScript) or executables spawned from common user directories.
## Related Tools/Techniques
- Similar to simple screen lockers, but leverages continuous GUI destruction rather than traditional encryption or full-screen takeover.
***
# Technique: Exploitation of AI Hype for Initial Access
## Overview
This refers to the tactical use by cybercriminals of current, high public interest in Artificial Intelligence (AI) tools (like ChatGPT or InVideo AI) as a theme for social engineering and malware distribution campaigns.
## Technical Details
- Type: Technique (Delivery/Social Engineering)
- Platform: Cross-platform (Delivery mechanism targets end-users across various systems)
- Capabilities: Deception, malware masquerading.
- First Seen: Ongoing trend capitalizing on current events (AI boom).
## MITRE ATT&CK Mapping
- TA0001 - Initial Access
- T1566 - Phishing
- T1566.002 - Spearphishing Link (If links are used for downloads)
- T1566.001 - Spearphishing Attachment (Relates to distributing malicious installers)
## Functionality
### Core Capabilities
- Masquerading: Packaging malicious payloads (like Lucky\_Gh0\$t) within files that appear to be highly desirable AI software updates or installers.
- Luring Victims: Using attractive names or claims (e.g., "ChatGPT 4.0 full version") to entice users into downloading and executing malware from untrusted sources.
### Advanced Features
- Delivery via Self-Extracting Archives: Using SFX archives that contain both seemingly legitimate components (Microsoft open-source AI tools) and the hostile payload to bypass static analysis.
## Indicators of Compromise
- Behavioral Indicators: Observing the download and execution of executable files claiming to be associated with AI software downloaded from non-official sources.
## Associated Threat Actors
- Various actors utilizing social engineering themes targeting current trends.
## Detection Methods
- Behavioral detection: Monitoring for execution of self-extracting archives containing mixed content (legitimate tools alongside malware).
- Network Indicators: Blocking domains associated with hosting deceptive AI software installers.
## Mitigation Strategies
- Prevention measures: Mandate strict endpoint policies regarding software installation permissions. Educate users on verifying the source authenticity of popular software, especially trending tools.
- Hardening recommendations: Deploy application control solutions that prevent execution from temporary or download folders unless explicitly approved.
## Related Tools/Techniques
- General social engineering tactics adapted to exploit current technology trends.