Full Report
On 2022-06-21, a campaign was reported, involving DarkRadiation operator, gaining initial access via Unknown, while using Database ransomware, Disk Wipe, Remotely execute commands or scripts on a VM , Rootkit - LD_PRELOAD, targeting Docker to achieve RansomOp.
Analysis Summary
# Tool/Technique: DarkRadiation (Docker-Targeting Ransomware)
## Overview
DarkRadiation is a sophisticated ransomware strain written in Bash, specifically designed to target Linux environments, cloud infrastructures, and Docker containers. Unlike traditional Windows ransomware, DarkRadiation utilizes a modular Bash-based framework to automate the encryption of databases, persistence via rootkit techniques, and final-stage disk wiping to ensure maximum operational disruption.
## Technical Details
- **Type:** Malware Family (Ransomware / Wiper)
- **Platform:** Linux, Docker, Cloud Environments
- **Capabilities:** Database encryption, Disk wiping, Rootkit persistence, Command execution on VMs.
- **First Seen:** Reported significantly in June 2022 (variants appearing since 2021).
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- T1610 - Deploy Container
- **TA0003 - Persistence**
- T1574.006 - Hijack Execution Flow: LD_PRELOAD
- **TA0005 - Defense Evasion**
- T1574.006 - Hijack Execution Flow: LD_PRELOAD (Rootkit functionality)
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact (Database Ransomware)
- T1485 - Data Destruction (Disk Wipe)
- T1491 - Defacement
## Functionality
### Core Capabilities
- **Targeted Database Ransomware:** Specifically identifies and encrypts high-value database files to force ransom payments.
- **Docker Exploitation:** Leverages the Docker API and misconfigured containers to spread through the environment or gain initial entry.
- **Remote Execution:** Capable of executing arbitrary commands or secondary scripts on compromised Virtual Machines (VMs).
### Advanced Features
- **LD_PRELOAD Rootkit:** Utilizes the `LD_PRELOAD` environment variable to intercept system calls and hide malicious processes or files from standard administrative tools (e.g., `ps`, `ls`), making detection difficult.
- **Wiper Functionality:** Includes a destructive "Disk Wipe" component used either as a failed ransom fallback or a primary objective to destroy forensic evidence and disrupt operations.
## Indicators of Compromise
- **File Names:** `dark`, `api.sh`, `radiant.sh` (Commonly varies)
- **Network Indicators:**
- [h]xxp[:]//api[.]darkradiation[.]com
- [h]xxps[:]//sh[.]darkradiation[.]info
- **Behavioral Indicators:**
- Unexpected modifications to `/etc/ld.so.preload`.
- High frequency of `find` commands searching for `.db`, `.sql`, or `.sqlite` extensions.
- Large-scale deletion of files in `/var/lib/docker/volumes`.
## Associated Threat Actors
- **DarkRadiation Operator** (Cybercriminal group specialized in Linux/Container attacks).
## Detection Methods
- **Signature-based detection:** Scan for Bash scripts containing specific base64 encoded strings used for encryption routines.
- **Behavioral detection:**
- Monitor for changes to the `LD_PRELOAD` environment variable.
- Audit Docker API logs for unauthorized container deployments or remote command executions.
- Alert on mass file renaming/encryption activities originating from a single shell script.
## Mitigation Strategies
- **Container Hardening:** Disable the Docker API on public-facing interfaces and use TLS for authentication.
- **System Integrity:** Monitor `/etc/ld.so.preload` for unauthorized changes via File Integrity Monitoring (FIM).
- **Least Privilege:** Ensure Docker processes do not run as `root` where possible and use `apparmor` or `selinux` profiles.
- **Backups:** Maintain offline, immutable backups of critical databases to recover from wiper or ransomware attacks.
## Related Tools/Techniques
- **TeamTNT:** Another threat actor known for targeting Docker and Linux environments.
- **Kinsing:** Malware often found targeting misconfigured Docker APIs.
- **HiddenWall:** A Linux kernel module/rootkit technique similar in purpose to LD_PRELOAD hijacking.