curumim

Technical Breakdown:
───────────────────

1. File Extension & Renaming Patterns
   • Confirmation of File Extension: “.curumim” (lowercase; appended after the original extension—so report.xlsx → report.xlsx.curumim).
   • Renaming Convention: Besides the extension swap, filenames remain unchanged; however, in a few strains nicknamed “black-curumim”, a 64-byte hexadecimal “proof-of-ID” string is also prefixed (e.g., 9F765C[…]0AB_report.xlsx.curumim).

2. Detection & Outbreak Timeline
   • First public sightings surfaced 12–14 April 2024 in Brazil (the name “curumim” is Portuguese for “child” or “youth”)—likely lifted from the CurumIM Ransomware-as-a-Service forum ads that appeared in underground Telegram channels one week earlier.
   • Mass-propagation spike occurred around 25–27 April 2024 when the operator pushed the updated variant that exploits CVE-2023–22515 (Confluence privilege-escalation).

3. Primary Attack Vectors
   • Exploitation of public-facing vulnerabilities (top three 2024 targets):
   – CVE-2023–22515 (Atlassian Confluence Data Center & Server)
   – CVE-2023–34362 / MOVEit SQLi (rare but observed)
   – Fortigate CVE-2023–27997 (SSL-VPN heap-overflow)
   • RDP brute-force & credential stuffing (often via leaked stealer logs).
   • Malspam phishing with OneDrive/SharePoint link lures abusing “.ISO” or “.CHM” files containing CurumIM Dropper.
   • Lateral movement once inside: WMI, PsExec, and the EternalBlue back-ported toolkit (yes, still some unpatched 2019-era Win7/Srv2008 boxes).

Remediation & Recovery Strategies:
──────────────────────────────────

1. Prevention
   • Patch priority list: Confluence, MOVEit Transfer/FortiOS, Remote-Desktop-Services.
   • Disable SMBv1 everywhere; enforce RDP NLA / account lockout policies (max 3 failed logins).
   • EDR rules: block unsigned binaries writing to C:\ProgramData\CurumIM_vault.exe or creating scheduled tasks matching “CurumIMTask”.
   • Network segmentation to prevent lateral SMB/WMI abuse.
   • Multifactor authentication on VPN and RDP gateways.

2. Removal (post-detonation)
   Step 1 Immediately isolate the host from LAN (pull cable/disable WiFi).
   Step 2 Boot into Windows Safe Mode + Networking or WinPE.
   Step 3 Track & kill the CurumIM processes (tasklist | findstr curumim/vault).
   Step 4 Delete persistence artifacts:
   • Scheduled task “CurumIMTask”
   • Registry Run key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\CurumIMVault
   • Services: “CurumIMVSS” (Volume-Shadow-copy deleter)
   Step 5 Use Windows Defender Offline scan or reputable EDR cleanup (Malwarebytes, Sophos, SentinelOne).
   Step 6 Only after full removal and reboot proceed to recovery steps below.

3. File Decryption & Recovery
   • Current status (June 2024): NO OFFICIAL DECRYPTOR; encryption uses Curve25519 + ChaCha20-Poly1305, keys kept offline.
   • Free options:
   – CurumIM’s TOR chat occasionally drops working keys for “research customers”. Scrapers monitor the leak; when public keys appear the community-driven “CurBroken” tool can restore files. (Check Emsisoft Decryptor, but as of 10 June 2024 the key-set is still incomplete.)
   • Fallback tactics:
   – Shadow-copy, Veeam or Windows Server backups. CurumIM wipes only basic vssadmin shadows; advanced recovery (SQUID, Veeam VRB) often survives.
   – Exchange / SQL native application-level backups usually untouched.
   • Do NOT pay—samples show that CurumIM rehab fee is set at 1.2 BTC with spotty key delivery.

4. Other Critical Information
   • Wipers variant: When run with “/wipe” switch on domain controllers it overwrites MFT sectors—so every pre-boot recovery option should be tested on cloned disks.
   • Evasion: respects locale/language ID 0436 (Brazil-Portuguese) to skip infections—cannot be relied on for “air-gapping”.
   • Broader Impact: The affiliate program advertises a 35 % cut; logs indicate >340 companies might have been breached before April 2024 patching cycle started (not all encrypted yet). Government CERT.BR reports name healthcare, agriculture, and legal firms as primary verticals.

Keep backup images stored offline or in immutable cloud vaults—every additional offline copy doubles your recovery odds when CurumIM (or the next variant) rolls around.