VHD Ransomware

lazarus.day

Kaspersky linked VHD ransomware operations to Lazarus after incident-response evidence found the MATA framework backdoor in the same victim environment and no sign of another actor during the intrusion. The campaign used victim-specific spreading utilities, administrative credentials, SMB brute forcing, WMI execution, VPN exploitation, Active Directory takeover, and network-wide ransomware staging, while later reporting framed VHD as part of DPRK-linked financially motivated ransomware experimentation.

ThaiCERT Threat Group Cards

Lazarus on the hunt for big game https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Reported: 2020-07; Victims: VHD Ransomware; Motivations: FinancialGain; Sectors: None; Countries: Worldwide

Check Point Research

The North Korean APT group Lazarus has developed and used its own custom ransomware, dubbed VHD, indicating its intensions to join the profitable ransomware scene. Researchers attribute VHD to Lazarus since it was used together with the MATA backdoor, a signature tool of Lazarus.

Hackmageddon

Researchers from Kaspersky reveal that North Korean-backed hackers from the Lazarus Group have developed and are actively using VHD ransomware against enterprise targets.

Kaspersky Securelist

By investigating a number of targeted ransomware attacks and through discussions with some of our trusted industry partners, we feel that we now have a good grasp on how the ransomware ecosystem is structured.

Case #1: The VHD ransomware This first incident occurred in Europe