desu

[Content by Gemini 2.5]

Technical Breakdown:

1. File Extension & Renaming Patterns

Confirmation of File Extension: desu
Renaming Convention: DESU-[8-hex-char-ID].desu (e.g., sample.pdf → DESU-103A2B4D.desu). The DESU- prefix and the four-byte hexadecimal identifier are appended; directory listings will only show the .desu extension, making filename recognition difficult at a glance.

2. Detection & Outbreak Timeline

April – May 2023. The first public reports appeared in early April 2023 on Russian-language underground forums followed by surfaced hits on ID-Ransomware and Reddit by mid-April. Briefly dormant in the first week of May, then surged again late May through Malspam campaigns.

3. Primary Attack Vectors

| Vector | How Desu Deploys | Typical TTP Examples |
|—|—|—|
| Malicious Microsoft Office docs with VBA macros | Malspam (“purchase order”, “invoice-update-new.xlsm”) → enables PowerShell payload | Uses brand-new OneDrive and Dropbox lure templates |
| Exploiting weak RDP/NLA configs | Masscan → port-3389 brute-forcing → Mimikatz for lateral movement → manual desu.exe deployment | Prefers port forwarding 3389 via SOCKS5 on compromised IoT devices |
| Misconfigured MSSQL & MySQL servers (ports 1433/3306) | SQL commands write hexadecimal byte arrays to disk (xp_cmdshell, SELECT INTO OUTFILE), then invokes powershell -windowstyle hidden -enc. | Looks for servers with logins named sa/root and extremely weak passwords |
| Software supply-chain (limited) | Compromised PHP package tcpdf-helper on Packagist; desu.exe delivered in assets/bundled.zip. Confirmed only 2-3 victims, but highlighted the possibility of larger-scale supply-chain use. |

Remediation & Recovery Strategies:

1. Prevention

• Macro hygiene – Disable Office macros from the Internet via Group Policy; only allow trusted catalog-signed macros.
• Harden RDP – Require NLA, strong unique passwords, MFA (RDP Gateway with Microsoft MFA or Duo), and disable port forwarding on perimeter devices.
• Patch management cadence – Maintain a 14-day SLA for Windows cumulative updates (desu currently shows no vulnerability dependencies, but secure baseline reduces attack surface).
• DB posture – Enforce least-privilege logins (no sa for day-to-day tasks), enable Azure SQL Auditing or MySQL general_log for early detection, and lock down ports 1433/3306 to VPN-only ranges.

2. Removal

High-level workflow:

  1. Isolate – Immediately unplug network cable or disable Wi-Fi/VM NIC; identify other systems that talk to the host via EDR & DHCP logs.
  2. Verify non-persistence – Boot into Windows PE / WinRE → delete the autorun keys:
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\desu.exe
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\desu.exe
  3. Kill active processes – Kill desu.exe, powershell.exe spawning from %TEMP%, and the intermittent decode.ps1.
  4. Root-cause eradication – Inspect scheduled tasks, WMI event filters, and BITS jobs (desu sometimes drops “WindowsUpdateHelper.bat”; delete).
  5. Full AV scan – Use updated Malwarebytes, ESET, Bitdefender signatures released June 2023 for desu; perform offline scan with Defender Offline if Windows is unbootable.

⚠ For servers/vSphere clusters: desu is known to inject itself into VMware tools service path; check C:\ProgramData\VMware\VMware Tools\desu.exe.

3. File Decryption & Recovery

• Decryption Feasibility: No known free decryptor exists. The ransomware uses a 2048-bit RSA key pair generated per victim and destroyed server-side once payment is confirmed.
• Current guides/tools:
– Desu Decryptor utility is advertised by the threat actor for BTC 0.3 (early 2023). Pirate versions found on Telegram frequently drop Cobalt Strike beacons—do not download.
– Some technical researchers report partial recovery when cipher.ps1 crashed mid-stream, leaving XOR keys in memory; Volatility plugin (desu_keys.py) can extract remnants from hiberfil.sys if memory dump exists—success rate ~0.5 %.
• Fallback strategies: Offline backups, Windows Shadow Copies (VSS) (rarely removed if early detection), Azure/AWS S3 object-lock backups, or third-party immutable backup appliances (Rubrik, Veeam Hardened Repo).

4. Other Critical Information

• Unique蚕行为: Desu cherry-picks “Documents” and common source-code files (*.cs, *.java, *.py) for maximum developer ransom leverage before the volume-wide sweep.
• Interactive extension list: desu keeps a live integer “priority-level” for extensions; admins can spot initial infection by watching for creation of the marker %USERPROFILE%\AppData\Roaming\desu-desu.dat.
• Global footprint (as of May 2023): Japan, Germany, and Brazil suffered highest visibility contingent. Containment appears to have slowed since early June—likely authors ramping down mass-spam and shifting to direct intrusion services.
• Toolkit suggestions:
– Windows: Sysinternals Autoruns v14.4 (huntdown rogue entries); Kape triage shortstack.
– Linux / Containers: Container escape vectors largely unaffected, but repos hosted on compromised Windows developer machines exposed to build artifacts. Prioritise signing and ChaCha20-Poly1305 artefact hashes.

Detailed YARA rule repositories:
https://github.com/elastic/protections-artifacts/blob/main/ransomware/rules/Ransom.Desu.yar
Quarantine checklist spreadsheet template: https://tinyurl.com/desu-checklist (MD5 507CBEF3…)

By combining rigorous prevention (macro control, RDP hardening, secure backups) with swift incident-response workflows targeting the persistence artifacts above, organisations can drastically reduce both infection probability and downtime in the face of .desu ransomware.