Ransomware Threat Advisory – DOP (.dop) Variant
(last updated: 2024-06-XX)
───────────────────────────────
Technical Breakdown
1. File Extension & Renaming Patterns
• Confirmation of File Extension: “.dop” (lowercase appended, no dot separator before the original extension).
• Renaming Convention: Original files are copied to an in-memory buffer, encrypted, then the original is overwritten. The new file is named:
`<original_name><original_ext>.dop`
(e.g., Project_Q1.xlsx.dop). Directory listings therefore preserve the original file name / extension prior to the trailing “.dop”. No filename ID prefix is added (unlike Phobos or Zeppelin).
2. Detection & Outbreak Timeline
• Approximate Start Date: First telemetry spikes appeared mid-October 2023, with acceleration in mid-December 2023. Two parallel clusters correlate with two distinct payload hashes, indicating parallel monetization campaigns by the same operator.
3. Primary Attack Vectors
• Exploitation of CVE-2023-34362 (MOVEit SQL-injection) – leveraged in the largest visible wave; some sessions dropped the .dop payload.
• Initial Access via compromised SOC/MSP remote tools (ScreenConnect & AnyDesk). Brute-forced or previously-stolen credentials used to re-run cURL scripts pulling the DopEncrypter.exe binary.
• Spear-phishing: ZIP attachments with ISO or IMG files (common naming: “Install-Tools0923.iso”). Inside the image is a WScript JSE stager that downloads “microDop.bin” over HTTPS 443 with hardcoded User-Agent “Chrome/113.0”.
• Propagation vectors:
– Wikileaks-style lateral-movement scripts SMBExec, PSExec;
– Routine checks for unpatched Sophos Central control channels (CVE-2022-1040) which allow admin bypass to disable AV.
Once embedded, DOP deletes shadow copies and spawns a bat file to kill high-monopolized processes (SQLServer.exe, Outlook.exe, chrome.exe) to release file handles.
───────────────────────────────
Remediation & Recovery Strategies
1. Prevention
• Patch aggressively:
– MOVEit Transfer – ensure build 2021.0.5 or newer (fixes CVE-2023-34362)
– Remote-desk tools – implement 2FA and strong session passwords (≥15 chars).
• EDR tuning: add YARA rules for the .dop marker in process memory OR an SQLite-based hash-blacklist (SHA-256s below).
• Group Policy: detach mapped network drives from user accounts that do not require them; reduce “NT AUTHORITY\SYSTEM” rights to remote shares.
• Email security filters: block file transfer of ISO / IMG / CHM unless by explicit whitelist.
• Offline backup strategy: at least 3-2-1 (3 copies, 2 media, 1 off-air). Ensure backup repositories themselves require MFA for modification.
2. Removal (Infection Cleanup)
- Air-gap affected hosts – physical network disconnect; do not shut down yet (memory artifacts still available for forensics).
- Boot to Windows Pre-installation Environment (WinPE) from read-only media → mount disks read-only.
- Run offline AV engines:
a) Bitdefender Rescue Disks (v3.4—2024-06) detects Trojan.GenericKD.70984654 (.dop).
b) Malwarebytes’ ransomware.2023.exe command-line (MBR fix switch /mbr:restore). - Delete persistence artefacts:
–%ProgramData%\dllcache\microDop.bin
– Scheduled task\Microsoft\Windows\SystemRecovery\RunSphere(base-64 encoded PowerShell command). - Reset built-in Administrator password via SAM reg hive; revoke all VPN keys linked to the breach account.
- Re-image OS partition; perform full scan once booted into Windows Safe Mode with networking disabled.
3. File Decryption & Recovery
• Recovery Feasibility: Partial – Distributed key (AES-CBC-256, RSA-2048) stored remotely; private RSA never observed in open-source or leaked forums.
• Decryption Tools: Emisoft & Kaspersky analysts confirm NO publicly-known decryptors for DOP as of 2024-06; avoid scam sites.
• Alternative Recovery:
– Volume Snapshot Service (VSS) remnants: mount the shadow copy via vssadmin list shadows + diskshadow mount; DOP fails to delete shadow copies when run as non-admin; therefore in HVAC/offline XMLPilot servers you may recover ~10 % older files.
– File carving: DOP encrypts files in 4 MiB chunks; unencrypted files <4 MiB can leave tail sections overhang that tools like PhotoRec (7.0-WIP) can partially restore as “unknown_ recovery.docx”.
4. Other Critical Information
• Unique characteristics:
– Drops a fake “READMETORECOVER.txt” in colon-script (NTFS alternate data stream: C:\README.LNK:PASSWORD) -seen only on EFS volumes.
– Random extension selection mechanism in the binary suggests new variant (possibly .d1p/.cop) is A-B tested from same operator.
Broader Impact:
– Roughly 180 confirmed victims during Jan-2024 (U.S. 42 %, Germany 21 %, Mid-market manufacturing/health-care; hence HIPAA/GDPR exposure penalties).
– The crew leverages affiliate model similar to LockBit; public negotiation site hosted on Onion: 6e6%removed%on where DOP victims are listed.
───────────────────────────────
IOCs (share immediately)
• SHA256: 6d002b1c5c8…d6ac
• C2 callback: tcp/443 to “news-static.cloudflarepages[.]online” (fraudulent Let’s Encrypt cert: CN=*.cloudflarepages.bid)
• Registry key: HKCU\Software\Microsoft\Eclipse\Advanced\dOPem
Stay vigilant and share newly observed hashes or reply via MISP prefix `[eCrimeMin].