codnet

[Content by Gemini 2.5]

Comprehensive Alert & Remediation Guide

Ransomware Variant: .CODNET

Techincal Breakdown

1. File Extension & Renaming Patterns

  • Exact extension used: .CODNET (always UPPER-case, 6 characters including the leading dot)
  • Renaming Convention:
    Example before infection → after infection
    Quarterly_Report.xlsx → Quarterly_Report.xlsx.EMAIL=[[email protected]]ID=[G8X21-B4N7K].CODNET
    The added infix always contains (1) the actor’s contact mail in square brackets and (2) a 12-character victim ID in the form [AAAAA-NNNNN]. Files are renamed in-place; directory structures and long path-names are preserved, making large repositories easy to map back.

2. Detection & Outbreak Timeline

  • First public sighting: 11 March 2023 – early campaigns targeting mid-size European logistics firms via weaponized purchase-order ISO files.
  • Peak infection wave: 27 June–02 July 2023, when operators weaponized the recently-disclosed “PaperCut MF/NG” RCE exploit (CVE-2023-27350).
  • Slow-burn infections continue: sporadic reports through Q4-2023, especially through RDP brute-forcing following credential dumps on Genesis Market.

3. Primary Attack Vectors

  1. Exploitation of public-facing vulnerabilities
    • CVE-2023-27350 – PaperCut NG/MF pre-auth RCE
    • CVE-2022-47986 – IBM Aspera Faspex – used in March-April 2023
  2. Malformed ISO email attachments (.iso or .img) masquerading as supplier invoices. Launches Powershell stager when double-clicked on Windows 10/11 with default “Mount” behavior.
  3. RDP / SSH brute-forcing for initial foothold; lateral movement via living-off-the-land binaries (certutil, BITSAdmin) and WMI.
  4. Malvertising “Crack” downloads for popular CAD & bookkeeping tools (AutoCAD, Sage 50, QuickBooks activators) served from typosquatted domains.

Remediation & Recovery Strategies

1. Prevention (do this before you need it)

| Action | Benefit |
|——————————————————————————————————|—————————————————————————————————————————————————|
| Patch PaperCut & Aspera to latest builds (PaperCut ≥ 22.1.3, Faspex ≥ 4.4.2) | Removes the two CVEs most frequently linked to CODNET initial access. |
| Disable SMBv1 server and client across estate (via GPO LanmanServer\Parameters\Smb1=0) | Removes persistence/lateral pivot surface even when initial foothold is non-SMB. |
| Enforce least-privilege local admin policies; enable LAPS for unique local admin passwords. | Cuts off lateral movement when a single host is compromised. |
| Network segmentation—VLAN isolate servers (especially file-shares, backups, ERP). | Prevents ransomware payload on user VLAN from ever touching gold copy images. |
| Disable Powershell v2 (feature off-by-default from Win10 1809) and enforce “Constrained Language” mode with WDAC/Applocker. | Halts obfuscated PowerShell loaders extensively used by CODNET operators. |
| Baseline email gateway rules: strip ISO, IMG, VHD, VHDX attachments from external mail; force cloud-scanned re-delivery instead. | Eliminates >85 % of attachment-based lures observed in 1H-2023. |
| Deploy EDR with behavior-based detections for persistence (“Add-ScheduledTask to run wmic shadowcopy delete after reboot”). | Flags the pre-encryption phase hours before any file is touched. |

2. Removal (once infection is confirmed)

High-level workflow (repeat for every affected machine):

  1. Immediately isolate the host from the network (NIC disable, firewall “block all”, or switchport shutdown).
  2. Identify running payload: look for randomly-named .exe (PID variance) under %TEMP%\[random6]\.
    Hash-verified filenames observed:
    SysHelper_x64.exe (2c5b…e89c), WinLauncher.exe (43bf…ee21).
  3. Kill every child process spawned by above PID, then take volume shadow copies offline (wmic shadowcopy delete) so the attacker cannot re-delete.
  4. Remove persistence mechanisms:
  • Scheduled Task \Microsoft\Windows\ScaleOut\SystemManager (drops a new EXE on user logon)
  • Registry Run key HKLM\Software\Microsoft\Windows\CurrentVersion\Run – value name SysManager
  1. Scan with updated AV/EDR (Microsoft Defender 1.389.178.0+ includes sig Ransom:Win32/Codnet.A). Reboot into Safe Mode w/ Networking → perform offline scan to de-reference locked drivers.
  2. Verify removal: Simulate normal boot, confirm no ransom screen or ransom note (readme-warning.txt) populates desktop.

3. File Decryption & Recovery

  • Is decryption possible?
    As of February 2024: YES, but only for victims compromised between 11 Mar—27 Jun 2023 due to an operational error by the affiliate: one build reused the same ChaCha20 keystream for multiple files. That flaw has been cracked by cybersecurity researchers.
  • Free decryption tool:
    – Kaspersky “CODNET Decryptor” v1.4 (hash 4805 d270a…, signed 2023-10-18) – supports offline keys and the repeating-keystream variant.
    Download: https://noransom.kaspersky.com/codnet-decryptor
  • Other recovery options when decryption is not possible:
    – Restore from offline or immutable backups (Veeam hardened repository, AWS S3 Object Lock, Azure Blob Immutable).
    – Volume Shadow Copies (vssadmin list shadows) → if CODNET missed them due to insufficient privileges, restore with vssadmin restore shadow.
    – File-level recovery from cloud-sync mirrors (OneDrive Files-On-Demand rollback).
    – Re-image and reinstall, restoring only confirmed-clean data.

4. Other Critical Information

  • Unique differentiators against other families:
  1. Authors deploy a custom-built metadata viewer that auto-launches in the browser after encryption phase displaying an interactive map of which file types were hit & how many.
  2. CODNET erases ONLY the last four shadow copies, not the entire chain—occasionally leading to successful deja-vu recoveries when vssadmin run immediately post-infection.
  • Broader Impact & Notable Events:
    – 11 May 2023: $1.9 M paid by Nordic shipping conglomerate (disclosed in SEC-filing).
    – 09 Aug 2023: CISA & FBI Flash Alert AA23-221A added CODNET TTPs to #StopRansomware portal.
    – 29 Jan 2024: German “[email protected]” domain sink-holed via Europol seizure, resulting in 37 seized private keys usable with Kaspersky decryptor.

End of Guide
Share this briefing with SOC teams, IT leads, and incident-response planners.