July 26, 2022

Identifying PrivateLoader Network Threats

Learn how Darktrace identifies network-based indicators of compromise for the PrivateLoader malware. Gain insights into advanced threat detection.

Written by

Sam Lister

SOC Analyst

Written by

Shuh Chin Goh

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Sam Lister

SOC Analyst

Written by

Shuh Chin Goh

Jul 2022

Instead of delivering their malicious payloads themselves, threat actors can pay certain cybercriminals (known as pay-per-install (PPI) providers) to deliver their payloads for them. Since January 2022, Darktrace’s SOC has observed several cases of PPI providers delivering their clients’ payloads using a modular malware downloader known as ‘PrivateLoader’.

This blog will explore how these PPI providers installed PrivateLoader onto systems and outline the steps which the infected PrivateLoader bots took to install further malicious payloads. The details provided here are intended to provide insight into the operations of PrivateLoader and to assist security teams in identifying PrivateLoader bots within their own networks.

Threat Summary

Between January and June 2022, Darktrace identified the following sequence of network behaviours within the environments of several Darktrace clients. Patterns of activity involving these steps are paradigmatic examples of PrivateLoader activity:

1. A victim’s device is redirected to a page which instructs them to download a password-protected archive file from a file storage service — typically Discord Content Delivery Network (CDN)

2. The device contacts a file storage service (typically Discord CDN) via SSL connections

3. The device either contacts Pastebin via SSL connections, makes an HTTP GET request with the URI string ‘/server.txt’ or ‘server_p.txt’ to 45.144.225[.]57, or makes an HTTP GET request with the URI string ‘/proxies.txt’ to 212.193.30[.]45

4. The device makes an HTTP GET request with the URI string ‘/base/api/statistics.php’ to either 212.193.30[.]21, 85.202.169[.]116, 2.56.56[.]126 or 2.56.59[.]42

5. The device contacts a file storage service (typically Discord CDN) via SSL connections

6. The device makes a HTTP POST request with the URI string ‘/base/api/getData.php’ to either 212.193.30[.]21, 85.202.169[.]116, 2.56.56[.]126 or 2.56.59[.]42

7. The device finally downloads malicious payloads from a variety of endpoints

The PPI Business

Before exploring PrivateLoader in more detail, the pay-per-install (PPI) business should be contextualized. This consists of two parties:

1. PPI clients - actors who want their malicious payloads to be installed onto a large number of target systems. PPI clients are typically entry-level threat actors who seek to widely distribute commodity malware [1]

2. PPI providers - actors who PPI clients can pay to install their malicious payloads

As the smugglers of the cybercriminal world, PPI providers typically advertise their malware delivery services on underground web forums. In some cases, PPI services can even be accessed via Clearnet websites such as InstallBest and InstallShop [2] (Figure 1).

Figure 1: A snapshot of the InstallBest PPI login page [2]

To utilize a PPI provider’s service, a PPI client must typically specify:

(A) the URLs of the payloads which they want to be installed

(B) the number of systems onto which they want their payloads to be installed

Payment of course, is also required. To fulfil their clients’ requests, PPI providers typically make use of downloaders - malware which instructs the devices on which it is running to download and execute further payloads. PPI providers seek to install their downloaders onto as many systems as possible. Follow-on payloads are usually determined by system information garnered and relayed back to the PPI providers’ command and control (C2) infrastructure. PPI providers may disseminate their downloaders themselves, or they may outsource the dissemination to third parties called ‘affiliates’ [3].

Back in May 2021, Intel 471 researchers became aware of PPI providers using a novel downloader (dubbed ‘PrivateLoader’) to conduct their operations. Since Intel 471’s public disclosure of the downloader back in Feb 2022 [4], several other threat research teams, such as the Walmart Cyber Intel Team [5], Zscaler ThreatLabz [6], and Trend Micro Research [7] have all provided valuable insights into the downloader’s behaviour.

Anatomy of a PrivateLoader Infection

The PrivateLoader downloader, which is written in C++, was originally monolithic (i.e, consisted of only one module). At some point, however, the downloader became modular (i.e, consisting of multiple modules). The modules communicate via HTTP and employ various anti-analysis methods. PrivateLoader currently consists of the following three modules [8]:

The loader module: Instructs the system on which it is running to retrieve the IP address of the main C2 server and to download and execute the PrivateLoader core module
The core module: Instructs the system on which it is running to send system information to the main C2 server, to download and execute further malicious payloads, and to relay information regarding installed payloads back to the main C2 server
The service module: Instructs the system on which it is running to keep the PrivateLoader modules running

Kill Chain Deep-Dive

The chain of activity starts with the user’s browser being redirected to a webpage which instructs them to download a password-protected archive file from a file storage service such as Discord CDN. Discord is a popular VoIP and instant messaging service, and Discord CDN is the service’s CDN infrastructure. In several cases, the webpages to which users’ browsers were redirected were hosted on ‘hero-files[.]com’ (Figure 2), ‘qd-files[.]com’, and ‘pu-file[.]com’ (Figure 3).

Figure 2: An image of a page hosted on hero-files[.]com - an endpoint which Darktrace observed systems contacting before downloading PrivateLoader from Discord CDN

Figure 3: An image of a page hosted on pu-file[.]com- an endpoint which Darktrace observed systems contacting before downloading PrivateLoader from Discord CDN

‍
On attempting to download cracked/pirated software, users’ browsers were typically redirected to download instruction pages. In one case however, a user’s device showed signs of being infected with the malicious Chrome extension, ChromeBack [9], immediately before it contacted a webpage providing download instructions (Figure 4). This may suggest that cracked software downloads are not the only cause of users’ browsers being redirected to these download instruction pages (Figure 5).

Figure 4: The event log for this device (taken from the Darktrace Threat Visualiser interface) shows that the device contacted endpoints associated with ChromeBack ('freychang[.]fun') prior to visiting a page ('qd-file[.]com') which instructed the device’s user to download an archive file from Discord CDN

Figure 5: An image of the website 'crackright[.]com'- a provider of cracked software. Systems which attempted to download software from this website were subsequently led to pages providing instructions to download a password-protected archive from Discord CDN

‍
After users’ devices were redirected to pages instructing them to download a password-protected archive, they subsequently contacted cdn.discordapp[.]com over SSL. The archive files which users downloaded over these SSL connections likely contained the PrivateLoader loader module. Immediately after contacting the file storage endpoint, users’ devices were observed either contacting Pastebin over SSL, making an HTTP GET request with the URI string ‘/server.txt’ or ‘server_p.txt’ to 45.144.225[.]57, or making an HTTP GET request with the URI string ‘/proxies.txt’ to 212.193.30[.]45 (Figure 6).

Distinctive user-agent strings such as those containing question marks (e.g. ‘????ll’) and strings referencing outdated Chrome browser versions were consistently seen in these HTTP requests. The following chrome agent was repeatedly observed: ‘Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36’.

In some cases, devices also displayed signs of infection with other strains of malware such as the RedLine infostealer and the BeamWinHTTP malware downloader. This may suggest that the password-protected archives embedded several payloads.

Figure 6: This figure, obtained from Darktrace's Advanced Search interface, represents the post-infection behaviour displayed by a PrivateLoader bot. After visiting hero-files[.]com and downloading the PrivateLoader loader module from Discord CDN, the device can be seen making HTTP GET requests for ‘/proxies.txt’ and ‘/server.txt’ and contacting pastebin[.]com

It seems that PrivateLoader bots contact Pastebin, 45.144.225[.]57, and 212.193.30[.]45 in order to retrieve the IP address of PrivateLoader’s main C2 server - the server which provides PrivateLoader bots with payload URLs. This technique used by the operators of PrivateLoader closely mirrors the well-known espionage tactic known as ‘dead drop’.

The dead drop is a method of espionage tradecraft in which an individual leaves a physical object such as papers, cash, or weapons in an agreed hiding spot so that the intended recipient can retrieve the object later on without having to come in to contact with the source. When threat actors host information about core C2 infrastructure on intermediary endpoints, the hosted information is analogously called a ‘Dead Drop Resolver’ or ‘DDR’. Example URLs of DDRs used by PrivateLoader:

https://pastebin[.]com/...
http://212.193.30[.]45/proxies.txt
http://45.144.225[.]57/server.txt
http://45.144.255[.]57/server_p.txt

The ‘proxies.txt’ DDR hosted on 212.193.40[.]45 contains a list of 132 IP address / port pairs. The 119^th line of this list includes a scrambled version of the IP address of PrivateLoader’s main C2 server (Figures 7 & 8). Prior to June, it seems that the main C2 IP address was ‘212.193.30[.]21’, however, the IP address appears to have recently changed to ‘85.202.169[.]116’. In a limited set of cases, Darktrace also observed PrivateLoader bots retrieving payload URLs from 2.56.56[.]126 and 2.56.59[.]42 (rather than from 212.193.30[.]21 or 85.202.169[.]116). These IP addresses may be hardcoded secondary C2 address which PrivateLoader bots use in cases where they are unable to retrieve the primary C2 address from Pastebin, 212.193.30[.]45 or 45.144.255[.]57 [10].

Figure 7: Before June, the 119th entry of the ‘proxies.txt’ file lists '30.212.21.193' - a scrambling of the ‘212.193.30[.]21’ main C2 IP address

Figure 8: Since June, the 119th entry of the ‘proxies.txt’ file lists '169.85.116.202' - a scrambling of the '85.202.169[.]116' main C2 IP address

Once PrivateLoader bots had retrieved C2 information from either Pastebin, 45.144.225[.]57, or 212.193.30[.]45, they went on to make HTTP GET requests for ‘/base/api/statistics.php’ to either 212.193.30[.]21, 85.202.169[.]116, 2.56.56[.]126, or 2.56.59[.]42 (Figure 9). The server responded to these requests with an XOR encrypted string. The strings were encrypted using a 1-byte key [11], such as 0001101 (Figure 10). Decrypting the string revealed a URL for a BMP file hosted on Discord CDN, such as ‘hxxps://cdn.discordapp[.]com/attachments/978284851323088960/986671030670078012/PL_Client.bmp’. These encrypted URLs appear to be file download paths for the PrivateLoader core module.

Figure 9: HTTP response from server to an HTTP GET request for '/base/api/statistics.php'

Figure 10: XOR decrypting the string with the one-byte key, 00011101, outputs a URL in CyberChef

After PrivateLoader bots retrieved the 'cdn.discordapp[.]com’ URL from 212.193.30[.]21, 85.202.169[.]116, 2.56.56[.]126, or 2.56.59[.]42, they immediately contacted Discord CDN via SSL connections in order to obtain the PrivateLoader core module. Execution of this module resulted in the bots making HTTP POST requests (with the URI string ‘/base/api/getData.php’) to the main C2 address (Figures 11 & 12). Both the data which the PrivateLoader bots sent over these HTTP POST requests and the data returned via the C2 server’s HTTP responses were heavily encrypted using a combination of password-based key derivation, base64 encoding, AES encryption, and HMAC validation [12].

Figure 11: The above image, taken from Darktrace's Advanced Search interface, shows a PrivateLoader bot carrying out the following steps: contact ‘hero-files[.]com’ --> contact ‘cdn.discordapp[.]com’ --> retrieve ‘/proxies.txt’ from 212.193.30[.]45 --> retrieve ‘/base/api/statistics.php’ from 212.193.30[.]21 --> contact ‘cdn.discordapp[.]com --> make HTTP POST request with the URI ‘base/api/getData.php’ to 212.193.30[.]21

Figure 12: A PCAP of the data sent via the HTTP POST (in red), and the data returned by the C2 endpoint (in blue)

These ‘/base/api/getData.php’ POST requests contain a command, a campaign name and a JSON object. The response may either contain a simple status message (such as “success”) or a JSON object containing URLs of payloads. After making these HTTP connections, PrivateLoader bots were observed downloading and executing large volumes of payloads (Figure 13), ranging from crypto-miners to infostealers (such as Mars stealer), and even to other malware downloaders (such as SmokeLoader). In some cases, bots were also seen downloading files with ‘.bmp’ extensions, such as ‘Service.bmp’, ‘Cube_WW14.bmp’, and ‘NiceProcessX64.bmp’, from 45.144.225[.]57 - the same DDR endpoint from which PrivateLoader bots retrieved main C2 information. These ‘.bmp’ payloads are likely related to the PrivateLoader service module [13]. Certain bots made follow-up HTTP POST requests (with the URI string ‘/service/communication.php’) to either 212.193.30[.]21 or 85.202.169[.]116, indicating the presence of the PrivateLoader service module, which has the purpose of establishing persistence on the device (Figure 14).

Figure 13: The above image, taken from Darktrace's Advanced Search interface, outlines the plethora of malware payloads downloaded by a PrivateLoader bot after it made an HTTP POST request to the ‘/base/api/getData.php’ endpoint. The PrivateLoader service module is highlighted in red

Figure 14: The event log for a PrivateLoader bot, obtained from the Threat Visualiser interface, shows a device making HTTP POST requests to ‘/service/communication.php’ and connecting to the NanoPool mining pool, indicating successful execution of downloaded payloads

In several observed cases, PrivateLoader bots downloaded another malware downloader called ‘SmokeLoader’ (payloads named ‘toolspab2.exe’ and ‘toolspab3.exe’) from “Privacy Tools” endpoints [14], such as ‘privacy-tools-for-you-802[.]com’ and ‘privacy-tools-for-you-783[.]com’. These “Privacy Tools” domains are likely impersonation attempts of the legitimate ‘privacytools[.]io’ website - a website run by volunteers who advocate for data privacy [15].

After downloading and executing malicious payloads, PrivateLoader bots were typically seen contacting crypto-mining pools, such as NanoPool, and making HTTP POST requests to external hosts associated with SmokeLoader, such as hosts named ‘host-data-coin-11[.]com’ and ‘file-coin-host-12[.]com’ [16]. In one case, a PrivateLoader bot went on to exfiltrate data over HTTP to an external host named ‘cheapf[.]link’, which was registered on the 14^th March 2022 [17]. The name of the file which the PrivateLoader bot used to exfiltrate data was ‘NOP8QIMGV3W47Y.zip’, indicating information stealing activities by Mars Stealer (Figure 15) [18]. By saving the HTTP stream as raw data and utilizing a hex editor to remove the HTTP header portions, the hex data of the ZIP file was obtained. Saving the hex data using a ‘.zip’ extension and extracting the contents, a file directory consisting of system information and Chrome and Edge browsers’ Autofill data in cleartext .txt file format could be seen (Figure 16).

Figure 15: A PCAP of a PrivateLoader bot’s HTTP POST request to cheapf[.]link, with data sent by the bot appearing to include Chrome and Edge autofill data, as well as system information

Figure 16: File directory structure and files of the ZIP archive

When left unattended, PrivateLoader bots continued to contact C2 infrastructure in order to relay details of executed payloads and to retrieve URLs of further payloads.

Darktrace Coverage

Most of the incidents surveyed for this article belonged to prospective customers who were trialling Darktrace with RESPOND in passive mode, and thus without the ability for autonomous intervention. However in all observed cases, Darktrace DETECT was able to provide visibility into the actions taken by PrivateLoader bots. In one case, despite the infected bot being disconnected from the client’s network, Darktrace was still able to provide visibility into the device’s network behaviour due to the client’s usage of Darktrace/Endpoint.

If a system within an organization’s network becomes infected with PrivateLoader, it will display a range of anomalous network behaviours before it downloads and executes malicious payloads. For example, it will contact Pastebin or make HTTP requests with new and unusual user-agent strings to rare external endpoints. These network behaviours will generate some of the following alerts on the Darktrace UI:

Compliance / Pastebin
Device / New User Agent and New IP
Device / New User Agent
Device / Three or More New User Agents
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous Connection / POST to PHP on New External Host
Anomalous Connection / Posting HTTP to IP Without Hostname

Once the infected host obtains URLs for malware payloads from a C2 endpoint, it will likely start to download and execute large volumes of malicious files. These file downloads will usually cause Darktrace to generate some of the following alerts:

Anomalous File / EXE from Rare External Location
Anomalous File / Numeric Exe Download
Anomalous File / Masqueraded File Transfer
Anomalous File / Multiple EXE from Rare External Locations
Device / Initial Breach Chain Compromise

If RESPOND is deployed in active mode, Darktrace will be able to autonomously block the download of additional malware payloads onto the target machine and the subsequent beaconing or crypto-mining activities through network inhibitors such as ‘Block matching connections’, ‘Enforce pattern of life’ and ‘Block all outgoing traffic’. The ‘Enforce pattern of life’ action results in a device only being able to make connections and data transfers which Darktrace considers normal for that device. The ‘Block all outgoing traffic’ action will cause all traffic originating from the device to be blocked. If the customer has Darktrace’s Proactive Threat Notification (PTN) service, then a breach of an Enhanced Monitoring model such as ‘Device / Initial Breach Chain Compromise’ will result in a Darktrace SOC analyst proactively notifying the customer of the suspicious activity. Below is a list of Darktrace RESPOND (Antigena) models which would be expected to breach due to PrivateLoader activity. Such models can seriously hamper attempts made by PrivateLoader bots to download malicious payloads.

Antigena / Network / External Threat / Antigena Suspicious File Block
Antigena / Network / Significant Anomaly / Antigena Controlled and Model Breach
Antigena / Network / External Threat / Antigena File then New Outbound Block
Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block
Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block

In one observed case, the infected bot began to download malicious payloads within one minute of becoming infected with PrivateLoader. Since RESPOND was correctly configured, it was able to immediately intervene by autonomously enforcing the device’s pattern of life for 2 hours and blocking all of the device’s outgoing traffic for 10 minutes (Figure 17). When malware moves at such a fast pace, the availability of autonomous response technology, which can respond immediately to detected threats, is key for the prevention of further damage.

Figure 18: The event log for a Darktrace RESPOND (Antigena) model breach shows Darktrace RESPOND performing inhibitive actions once the PrivateLoader bot begins to download payloads

Conclusion

By investigating PrivateLoader infections over the past couple of months, Darktrace has observed PrivateLoader operators making changes to the downloader’s main C2 IP address and to the user-agent strings which the downloader uses in its C2 communications. It is relatively easy for the operators of PrivateLoader to change these superficial network-based features of the malware in order to evade detection [19]. However, once a system becomes infected with PrivateLoader, it will inevitably start to display anomalous patterns of network behaviour characteristic of the Tactics, Techniques and Procedures (TTPs) discussed in this blog.

Throughout 2022, Darktrace observed overlapping patterns of network activity within the environments of several customers, which reveal the archetypal steps of a PrivateLoader infection. Despite the changes made to PrivateLoader’s network-based features, Darktrace’s Self-Learning AI was able to continually identify infected bots, detecting every stage of an infection without relying on known indicators of compromise. When configured, RESPOND was able to immediately respond to such infections, preventing further advancement in the cyber kill chain and ultimately preventing the delivery of floods of payloads onto infected devices.

IoCs

‍

MITRE ATT&CK Techniques Observed

References

[1], [8],[13] https://www.youtube.com/watch?v=Ldp7eESQotM

[2] https://news.sophos.com/en-us/2021/09/01/fake-pirated-software-sites-serve-up-malware-droppers-as-a-service/

[3] https://www.researchgate.net/publication/228873118_Measuring_Pay-per Install_The_Commoditization_of_Malware_Distribution

[4], [15] https://intel471.com/blog/privateloader-malware

[5] https://medium.com/walmartglobaltech/privateloader-to-anubis-loader-55d066a2653e

[6], [10],[11], [12] https://www.zscaler.com/blogs/security-research/peeking-privateloader

[7] https://www.trendmicro.com/en_us/research/22/e/netdooka-framework-distributed-via-privateloader-ppi.html

[9] https://www.gosecure.net/blog/2022/02/10/malicious-chrome-browser-extension-exposed-chromeback-leverages-silent-extension-loading/

[14] https://www.proofpoint.com/us/blog/threat-insight/malware-masquerades-privacy-tool

[16] https://asec.ahnlab.com/en/30513/

[17]https://twitter.com/0xrb/status/1515956690642161669

[18] https://isc.sans.edu/forums/diary/Arkei+Variants+From+Vidar+to+Mars+Stealer/28468

[19] http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

‍

Inside the SOC

Written by

Sam Lister

SOC Analyst

Written by

Shuh Chin Goh

The Darktrace Community

Watch the NIS2 Webinar

Blog

Identity

April 10, 2025

Bytesize Security: Insider Threats in Google Workspace

What is an insider threat?

An insider threat is a cyber risk originating from within an organization. These threats can involve actions such as an employee inadvertently clicking on a malicious link (e.g., a phishing email) or an employee with malicious intent conducting data exfiltration for corporate sabotage.

Insiders often exploit their knowledge and access to legitimate corporate tools, presenting a continuous risk to organizations. Defenders must protect their digital estate against threats from both within and outside the organization.

For example, in the summer of 2024, Darktrace / IDENTITY successfully detected a user in a customer environment attempting to steal sensitive data from a trusted Google Workspace service. Despite the use of a legitimate and compliant corporate tool, Darktrace identified anomalies in the user’s behavior that indicated malicious intent.

Attack overview: Insider threat

In June 2024, Darktrace detected unusual activity involving the Software-as-a-Service (SaaS) account of a former employee from a customer organization. This individual, who had recently left the company, was observed downloading a significant amount of data in the form of a “.INDD” file (an Adobe InDesign document typically used to create page layouts [1]) from Google Drive.

While the use of Google Drive and other Google Workspace platforms was not unexpected for this employee, Darktrace identified that the user had logged in from an unfamiliar and suspicious IPv6 address before initiating the download. This anomaly triggered a model alert in Darktrace / IDENTITY, flagging the activity as potentially malicious.

Figure 1: A Model Alert in Darktrace / IDENTITY showing the unusual “.INDD” file being downloaded from Google Workspace.

Following this detection, the customer reached out to Darktrace’s Security Operations Center (SOC) team via the Security Operations Support service for assistance in triaging and investigating the incident further. Darktrace’s SOC team conducted an in-depth investigation, enabling the customer to identify the exact moment of the file download, as well as the contents of the stolen documents. The customer later confirmed that the downloaded files contained sensitive corporate data, including customer details and payment information, likely intended for reuse or sharing with a new employer.

In this particular instance, Darktrace’s Autonomous Response capability was not active, allowing the malicious insider to successfully exfiltrate the files. If Autonomous Response had been enabled, Darktrace would have immediately acted upon detecting the login from an unusual (in this case 100% rare) location by logging out and disabling the SaaS user. This would have provided the customer with the necessary time to review the activity and verify whether the user was authorized to access their SaaS environments.

Conclusion

Insider threats pose a significant challenge for traditional security tools as they involve internal users who are expected to access SaaS platforms. These insiders have preexisting knowledge of the environment, sensitive data, and how to make their activities appear normal, as seen in this case with the use of Google Workspace. This familiarity allows them to avoid having to use more easily detectable intrusion methods like phishing campaigns.

Darktrace’s anomaly detection capabilities, which focus on identifying unusual activity rather than relying on specific rules and signatures, enable it to effectively detect deviations from a user’s expected behavior. For instance, an unusual login from a new location, as in this example, can be flagged even if the subsequent malicious activity appears innocuous due to the use of a trusted application like Google Drive.

Credit to Vivek Rajan (Cyber Analyst) and Ryan Traill (Analyst Content Lead)

Get the latest insights on emerging cyber threats

Attackers are adapting, are you ready? This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025.

Identity-based attacks: How attackers are bypassing traditional defenses
Zero-day exploitation: The rise of previously unknown vulnerabilities
AI-driven threats: How adversaries are leveraging AI to outmaneuver security controls

Stay ahead of evolving threats with expert analysis from Darktrace. Download the report here.

‍

Appendices

Darktrace Model Detections

SaaS / Resource::Unusual Download Of Externally Shared Google Workspace File

References

[1]https://www.adobe.com/creativecloud/file-types/image/vector/indd-file.html

MITRE ATT&CK Mapping

Technqiue – Tactic – ID

Data from Cloud Storage Object – COLLECTION -T1530

About the author

Vivek Rajan

Cyber Analyst

Blog

Network

April 18, 2025

RansomHub Ransomware: Darktrace’s Investigation of the Newest Tool in ShadowSyndicate's Arsenal

‍What is ShadowSyndicate?

ShadowSyndicate, also known as Infra Storm, is a threat actor reportedly active since July 2022, working with various ransomware groups and affiliates of ransomware programs, such as Quantum, Nokoyawa, and ALPHV. This threat actor employs tools like Cobalt Strike, Sliver, IcedID, and Matanbuchus malware in its attacks. ShadowSyndicate utilizes the same SSH fingerprint (1ca4cbac895fc3bd12417b77fc6ed31d) on many of their servers—85 as of September 2023. At least 52 of these servers have been linked to the Cobalt Strike command and control (C2) framework [1].

What is RansomHub?

First observed following the FBI's takedown of ALPHV/BlackCat in December 2023, RansomHub quickly gained notoriety as a Ransomware-as-a-Service (RaaS) operator. RansomHub capitalized on the law enforcement’s disruption of the LockBit group’s operations in February 2024 to market themselves to potential affiliates who had previously relied on LockBit’s encryptors. RansomHub's success can be largely attributed to their aggressive recruitment on underground forums, leading to the absorption of ex-ALPHV and ex-LockBit affiliates. They were one of the most active ransomware operators in 2024, with approximately 500 victims reported since February, according to their Dedicated Leak Site (DLS) [2].

ShadowSyndicate and RansomHub

External researchers have reported that ShadowSyndicate had as many as seven different ransomware families in their arsenal between July 2022, and September 2023. Now, ShadowSyndicate appears to have added RansomHub’s their formidable stockpile, becoming an affiliate of the RaaS provider [1].

Darktrace’s analysis of ShadowSyndicate across its customer base indicates that the group has been leveraging RansomHub ransomware in multiple attacks in September and October 2024. ShadowSyndicate likely shifted to using RansomHub due to the lucrative rates offered by this RaaS provider, with affiliates receiving up to 90% of the ransom—significantly higher than the general market rate of 70-80% [3].

In many instances where encryption was observed, ransom notes with the naming pattern “README_[a-zA-Z0-9]{6}.txt” were written to affected devices. The content of these ransom notes threatened to release stolen confidential data via RansomHub’s DLS unless a ransom was paid. During these attacks, data exfiltration activity to external endpoints using the SSH protocol was observed. The external endpoints to which the data was transferred were found to coincide with servers previously associated with ShadowSyndicate activity.

Darktrace’s coverage of ShadowSyndicate and RansomHub

Darktrace’s Threat Research team identified high-confidence indicators of compromise (IoCs) linked to the ShadowSyndicate group deploying RansomHub. The investigation revealed four separate incidents impacting Darktrace customers across various sectors, including education, manufacturing, and social services. In the investigated cases, multiple stages of the kill chain were observed, starting with initial internal reconnaissance and leading to eventual file encryption and data exfiltration.

Attack Overview

Internal Reconnaissance

The first observed stage of ShadowSyndicate attacks involved devices making multiple internal connection attempts to other internal devices over key ports, suggesting network scanning and enumeration activity. In this initial phase of the attack, the threat actor gathers critical details and information by scanning the network for open ports that might be potentially exploitable. In cases observed by Darktrace affected devices were typically seen attempting to connect to other internal locations over TCP ports including 22, 445 and 3389.

C2 Communication and Data Exfiltration

In most of the RansomHub cases investigated by Darktrace, unusual connections to endpoints associated with Splashtop, a remote desktop access software, were observed briefly before outbound SSH connections were identified.

Following this, Darktrace detected outbound SSH connections to the external IP address 46.161.27[.]151 using WinSCP, an open-source SSH client for Windows used for secure file transfer. The Cybersecurity and Infrastructure Security Agency (CISA) identified this IP address as malicious and associated it with ShadowSyndicate’s C2 infrastructure [4]. During connections to this IP, multiple gigabytes of data were exfiltrated from customer networks via SSH.

Data exfiltration attempts were consistent across investigated cases; however, the method of egress varied from one attack to another, as one would expect with a RaaS strain being employed by different affiliates. In addition to transfers to ShadowSyndicate’s infrastructure, threat actors were also observed transferring data to the cloud storage and file transfer service, MEGA, via HTTP connections using the ‘rclone’ user agent – a command-line program used to manage files on cloud storage. In another case, data exfiltration activity occurred over port 443, utilizing SSL connections.

Lateral Movement

In investigated incidents, lateral movement activity began shortly after C2 communications were established. In one case, Darktrace identified the unusual use of a new administrative credential which was quickly followed up with multiple suspicious executable file writes to other internal devices on the network.

The filenames for this executable followed the regex naming convention “[a-zA-Z]{6}.exe”, with two observed examples being “bWqQUx.exe” and “sdtMfs.exe”.

Figure 1: Cyber AI Analyst Investigation Process for the SMB Writes of Suspicious Files to Multiple Devices' incident.

Additionally, script files such as “Defeat-Defender2.bat”, “Share.bat”, and “def.bat” were also seen written over SMB, suggesting that threat actors were trying to evade network defenses and detection by antivirus software like Microsoft Defender.

File Encryption

Among the three cases where file encryption activity was observed, file names were changed by adding an extension following the regex format “.[a-zA-Z0-9]{6}”. Ransom notes with a similar naming convention, “README_[a-zA-Z0-9]{6}.txt”, were written to each share. While the content of the ransom notes differed slightly in each case, most contained similar text. Clear indicators in the body of the ransom notes pointed to the use of RansomHub ransomware in these attacks. As is increasingly the case, threat actors employed double extortion tactics, threatening to leak confidential data if the ransom was not paid. Like most ransomware, RansomHub included TOR site links for communication between its "customer service team" and the target.

Figure 2: The graph shows the behavior of a device with encryption activity, using the “SMB Sustained Mimetype Conversion” and “Unusual Activity Events” metrics over three weeks.

Since Darktrace’s Autonomous Response capability was not enabled during the compromise, the ransomware attack succeeded in its objective. However, Darktrace’s Cyber AI Analyst provided comprehensive coverage of the kill chain, enabling the customer to quickly identify affected devices and initiate remediation.

Figure 3: Cyber AI Analyst panel showing the critical incidents of the affected device from one of the cases investigated.

In lieu of Autonomous Response being active on the networks, Darktrace was able to suggest a variety of manual response actions intended to contain the compromise and prevent further malicious activity. Had Autonomous Response been enabled at the time of the attack, these actions would have been quickly applied without any human interaction, potentially halting the ransomware attack earlier in the kill chain.

Figure 4: A list of suggested Autonomous Response actions on the affected devices."

Conclusion

The Darktrace Threat Research team has noted a surge in attacks by the ShadowSyndicate group using RansomHub’s RaaS of late. RaaS has become increasingly popular across the threat landscape due to its ease of access to malware and script execution. As more individual threat actors adopt RaaS, security teams are struggling to defend against the increasing number of opportunistic attacks.

For customers subscribed to Darktrace’s Security Operations Center (SOC) services, the Analyst team promptly investigated detections of the aforementioned unusual and anomalous activities in the initial infection phases. Multiple alerts were raised via Darktrace’s Managed Threat Detection to warn customers of active ransomware incidents. By emphasizing anomaly-based detection and response, Darktrace can effectively identify devices affected by ransomware and take action against emerging activity, minimizing disruption and impact on customer networks.

‍Credit to Kwa Qing Hong (Senior Cyber Analyst and Deputy Analyst Team Lead, Singapore) and Signe Zahark (Principal Cyber Analyst, Japan)‍

[related-resource]

Appendices

Darktrace Model Detections

Antigena Models / Autonomous Response:

Antigena / Network / Insider Threat / Antigena Network Scan Block

Antigena / Network / Insider Threat / Antigena SMB Enumeration Block

Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity

Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block

Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block

Antigena / Network / Significant Anomaly / Antigena Controlled and Model Breach

Antigena / Network / Significant Anomaly / Antigena Significant Server Anomaly Block

Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block

Antigena / Network / External Threat / Antigena Suspicious Activity Block

Antigena / Network / External Threat / Antigena Suspicious File Pattern of Life Block

Antigena / Network / External Threat / Antigena File then New Outbound Block

Network Reconnaissance:

Device / Network Scan

Device / ICMP Address Scan

Device / RDP Scan
Device / Anomalous LDAP Root Searches
Anomalous Connection / SMB Enumeration
Device / Spike in LDAP Activity

C2:

Enhanced Monitoring - Device / Lateral Movement and C2 Activity

Enhanced Monitoring - Device / Initial Breach Chain Compromise

Enhanced Monitoring - Compromise / Suspicious File and C2

Compliance / Remote Management Tool On Server

Anomalous Connection / Outbound SSH to Unusual Port

External Data Transfer:

Enhanced Monitoring - Unusual Activity / Enhanced Unusual External Data Transfer

Unusual Activity / Unusual External Data Transfer

Anomalous Connection / Data Sent to Rare Domain

Unusual Activity / Unusual External Data to New Endpoint

Compliance / SSH to Rare External Destination

Anomalous Connection / Application Protocol on Uncommon Port

Enhanced Monitoring - Anomalous File / Numeric File Download

Anomalous File / New User Agent Followed By Numeric File Download

Anomalous Server Activity / Outgoing from Server

Device / Large Number of Connections to New Endpoints

Anomalous Connection / Multiple HTTP POSTs to Rare Hostname

Anomalous Connection / Uncommon 1 GiB Outbound

Lateral Movement:

User / New Admin Credentials on Server

Anomalous Connection / New or Uncommon Service Control

Anomalous Connection / High Volume of New or Uncommon Service Control

Anomalous File / Internal / Executable Uploaded to DC

Anomalous Connection / Suspicious Activity On High Risk Device

File Encryption:

Compliance / SMB Drive Write

Anomalous File / Internal / Additional Extension Appended to SMB File

Compromise / Ransomware / Possible Ransom Note Write

Anomalous Connection / Suspicious Read Write Ratio

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

83.97.73[.]198 - IP - Data exfiltration endpoint

108.181.182[.]143 - IP - Data exfiltration endpoint

46.161.27[.]151 - IP - Data exfiltration endpoint

185.65.212[.]164 - IP - Data exfiltration endpoint

66[.]203.125.21 - IP - MEGA endpoint used for data exfiltration

89[.]44.168.207 - IP - MEGA endpoint used for data exfiltration

185[.]206.24.31 - IP - MEGA endpoint used for data exfiltration

31[.]216.148.33 - IP - MEGA endpoint used for data exfiltration

104.226.39[.]18 - IP - C2 endpoint

103.253.40[.]87 - IP - C2 endpoint

*.relay.splashtop[.]com - Hostname - C2 & data exfiltration endpoint

gfs***n***.userstorage.mega[.]co.nz - Hostname - MEGA endpoint used for data exfiltration

w.api.mega[.]co.nz - Hostname - MEGA endpoint used for data exfiltration

ams-rb9a-ss.ams.efscloud[.]net - Hostname - Data exfiltration endpoint

MITRE ATT&CK Mapping

Tactic - Technqiue

RECONNAISSANCE – T1592.004 Client Configurations

RECONNAISSANCE – T1590.005 IP Addresses

RECONNAISSANCE – T1595.001 Scanning IP Blocks

RECONNAISSANCE – T1595.002 Vulnerability Scanning

DISCOVERY – T1046 Network Service Scanning

DISCOVERY – T1018 Remote System Discovery

DISCOVERY – T1083 File and Directory Discovery
INITIAL ACCESS - T1189 Drive-by Compromise

INITIAL ACCESS - T1190 Exploit Public-Facing Application

COMMAND AND CONTROL - T1001 Data Obfuscation

COMMAND AND CONTROL - T1071 Application Layer Protocol

COMMAND AND CONTROL - T1071.001 Web Protocols

COMMAND AND CONTROL - T1573.001 Symmetric Cryptography

COMMAND AND CONTROL - T1571 Non-Standard Port

DEFENSE EVASION – T1078 Valid Accounts

DEFENSE EVASION – T1550.002 Pass the Hash

LATERAL MOVEMENT - T1021.004 SSH

LATERAL MOVEMENT – T1080 Taint Shared Content

LATERAL MOVEMENT – T1570 Lateral Tool Transfer

LATERAL MOVEMENT – T1021.002 SMB/Windows Admin Shares

COLLECTION - T1185 Man in the Browser

EXFILTRATION - T1041 Exfiltration Over C2 Channel

EXFILTRATION - T1567.002 Exfiltration to Cloud Storage

EXFILTRATION - T1029 Scheduled Transfer

IMPACT – T1486 Data Encrypted for Impact

References

1. https://www.group-ib.com/blog/shadowsyndicate-raas/

2. https://www.techtarget.com/searchsecurity/news/366617096/ESET-RansomHub-most-active-ransomware-group-in-H2-2024

3. https://cyberint.com/blog/research/ransomhub-the-new-kid-on-the-block-to-know/

4. https://www.cisa.gov/sites/default/files/2024-05/AA24-131A.stix_.xml

About the author

Qing Hong Kwa

Senior Cyber Analyst and Deputy Analyst Team Lead, Singapore

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Identifying PrivateLoader Network Threats

Threat Summary

The PPI Business

Anatomy of a PrivateLoader Infection

Kill Chain Deep-Dive

Darktrace Coverage

Conclusion

IoCs

MITRE ATT&CK Techniques Observed

References

Bytesize Security: Insider Threats in Google Workspace

Why AI-powered Email Protection Became Essential for this Global Financial Services Leader

Enjoying the blog?

More in this series

RansomHub Ransomware: Darktrace’s Investigation of the Newest Tool in ShadowSyndicate's Arsenal

Cleo File Transfer Vulnerability: Patch Pitfalls and Darktrace’s Detection of Post-Exploitation Activities

Company Shuts Down Cyber-attacks with “Flawless” Detection and Response from Darktrace

Blog

Identity

April 10, 2025

Bytesize Security: Insider Threats in Google Workspace

What is an insider threat?

Attack overview: Insider threat

Conclusion

Get the latest insights on emerging cyber threats

Appendices

Darktrace Model Detections

References

MITRE ATT&CK Mapping

Blog

Network

April 18, 2025

RansomHub Ransomware: Darktrace’s Investigation of the Newest Tool in ShadowSyndicate's Arsenal

‍What is ShadowSyndicate?

What is RansomHub?

ShadowSyndicate and RansomHub

Darktrace’s coverage of ShadowSyndicate and RansomHub

Attack Overview

Internal Reconnaissance

C2 Communication and Data Exfiltration

Lateral Movement

File Encryption

Conclusion

Appendices

Darktrace Model Detections

List of Indicators of Compromise (IoCs)

MITRE ATT&CK Mapping

References