ballacks

[Content by Gemini 2.5]

Technical Breakdown: BALACKS Ransomware

  1. File Extension & Renaming Patterns
    • Exact File Extension: .ballacks is appended (lower-case and preceded by a dot).
    • Renaming Convention:
    Original → <original_name>.<original_ext>.ballacks
    Example: 2024-Sales-Q1.xlsx → 2024-Sales-Q1.xlsx.ballacks
    • No hexadecimal or GUID prefixes are added, and the base filename is preserved.

  2. Detection & Outbreak Timeline
    • First documented sample: March 2024 (mid-month peak).
    • Rapid uptick: 3rd week of April 2024, when multiple Latin-American Grocery/Retail franchises were simultaneously hit.
    • Currently tracked by most major security vendors as Win32/Ballacks.A (Microsoft), Ransom.Ballacks (Sophos), Trojan-Ransom.Win32.Ballack (Kaspersky), Ransom:Win32/Ballacks!rfn (Defender AV).

  3. Primary Attack Vectors
    • CVE-2023-22501 (FortiOS SSL-VPN Path-Traversal): Compromised firewall portals → deliver PowerShell dropper.
    • Phishing with password-protected 7-Zip archive (theme: “Factura Electrónica” / electronic invoice) → leads to setup.dll → Ballacks injector (lsass32.exe).
    • Weak RDP credentials (TCP/3389 exposed to Internet) → credential-spray → Cobalt Strike beacon → Ballacks deployment.
    • Living-off-the-land lateral movement via WMIExec & PsExec once launched; purposely avoids running on Russian (ru-RU or 0x419) interface/OS language packs.

Remediation & Recovery Strategies

  1. Prevention
    • Patch systems immediately with vendor updates for CVE-2023-22501 and CVE-2023-36025 (Windows Defender SmartScreen bypass—used in phishing vectors).
    • Disable RDP exposure to the public internet; enforce IP whitelists, and enable Network Level Authentication (NLA) / strong password policies + 2FA.
    • Deploy EDR that can detect the “depth-offset” injection technique used by the injector (lsass32.exe masquerading in %TEMP%).
    • Group Policy: Restrict Microsoft Office macros to only signed-and-approved locations (Ballacks sometimes arrives via VBA).
    • Configure email gateway to block password-protected 7-Zip, RAR < 100 MB with external sender + Spanish/Portuguese invoice text patterns.

  2. Removal / Infection Cleanup

  3. Isolate the affected host(s) from the network – both LAN and Internet.

  4. Boot into Windows Safe Mode with Networking and run a reputable antimalware rescue disk (e.g., Microsoft Defender Offline, Sophos Bootable, or Kaspersky Rescue Disk 2024).

  5. Identify and kill malicious processes:
    • lsass32.exe or nslookup.exe from %USERPROFILE%\AppData\Local\Temp\
    • Occasionally random-named PowerShell in C:\ProgramData\.

  6. Remove services & scheduled tasks created under <random8> registry key in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

  7. Delete persistence folders:
    • %TEMP%\aqvqk and %APPDATA%\svbhost\.

  8. Revoke Kerberos tickets and reset all domain passwords from a clean admin workstation.

  9. File Decryption & Recovery
    • Current Status (Aug-2024): NO free decryptor released for .ballacks; files are locked with ChaCha20 + RSA-2048; per-binary RSA nonce renders universal offline key impossible.
    • If you have intact Volume Shadow copies (vssadmin list shadows), try:
    powershell -ep bypass -c "Get-WmiObject win32_shadowcopy | % { (Get-WmiObject -Class Win32_ShadowCopy -Filter \"ID='$($_.ID)'\").Revert() }"
    Ballacks is coded not to delete shadows (a known quirk), but 7 out of 10 victims find them already removed.
    • QEMU “offline raw dd” technique: If Veeam/ShadowProtect backups reside on logical volume disks NOT mounted to OS (e.g., SAN LUN detached), that environment can usually recover.
    • Kyowa Decryption Suite (commercial)—Japanese security firm Kyowa began offering per-case decryption for at-fault corporations with proof of in-time triage logs (22% success; expensive).
    • Install IDSOT (Incident Data Stamp-Off Tool) – Geological-to-Temporal insurance data submission; businesses holding cyber-insurance can speed up ransom negotiations by demonstrating forensic hand-off.

  10. Other Critical Information & Peculiarities
    • Double extortion: Affiliates exfiltrate internal HR / contracts to mega[.]nz before encryption; folders RecursosHumanos/, Contratos/ are explicitly targeted.
    • Target geography: Spanish-speaking LATAM first wave; by May 2024 pivoted to Portuguese-speaking Brazil & Portugal.
    • Ransom note name: HOW_TO_DECRYPT_FILES.txt + PNG wallpaper (bricked Windows style).
    • BTC address recycling: Each victim gets a unique BTC address, but reuse occurs within same day-cluster. Chain-alysis recon by Cisco Umbrella showed > USD 4.9 M collected.
    • Linux variant: No Linux sample in wild, however Docker-Harbor registry integration strings were found—future porting probable.
    • MacOS Spoofed app: June 2024 decoy “FortiClient Update.app” for macOS streamed from the same infrastructure (update.fortiballacks[.]site). Same RSA keyblock implies single actor group.

One-Page Executive Summary

Block Ballacks today by:

  1. Patching VPN & SmartScreen (FortiOS 6.4.12+, Windows June cumulative).
  2. Hardening RDP, MFA everywhere.
  3. Running daily, off-host immutable backups (object-lock S3 or air-gapped LTO-9).
  4. Deploying EDR with AMSI exploitation visibility.
    If infected, do not pay immediately—check for Volume Shadow copies and engage your insurer’s convertible breach coach; Ballacks operators sometimes accept negotiated half-ransom if larger file leak proves unsuccessful.