Follow
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
Makop ransomware, a strain within the Phobos family, is hitting organisations by abusing exposed Remote Desktop Protocol (RDP) services and leveraging off-the-shelf utilities for discovery, lateral movement, and privilege escalation. The campaign incorporates new elements, including the GuLoader downloader and several local privilege escalation exploits. Adversaries deploy the ransomware binary into user directories under misleading filenames. The threat mainly targets Indian enterprises, with activity also observed in Brazil and Germany.
Investigation
The Acronis Threat Research Unit examined recent Makop cases and mapped a repeatable attack chain that begins with RDP brute-force attempts, then proceeds to network scanning, credential dumping, and the execution of several CVE-driven elevation-of-privilege exploits. GuLoader was seen delivering follow-on payloads such as AgentTesla and FormBook. Investigators also documented the AV-killing tools, vulnerable drivers, and custom uninstallers used to neutralise security solutions.
Mitigation
Recommended defences include enforcing multi-factor authentication on RDP, eliminating any internet-exposed RDP endpoints, applying patches for all referenced CVEs, monitoring for known loader binaries and AV-killer utilities, and using endpoint detection to block suspicious script execution. Keeping Windows Defender signatures current and restricting the use of unsigned or untrusted drivers further reduces exposure to the observed techniques.
Response
Once activity is detected, immediately isolate the impacted host, terminate GuLoader or suspicious downloader processes, and capture volatile memory for analysis. Perform a comprehensive review of potential credential dumping, block known malicious file hashes and filenames, and remediate the exploited CVEs. Where feasible, restore encrypted data from verified backups and alert the appropriate incident response and management teams.
“`mermaid graph TB %% Class Definitions Section classDef action fill:#99ccff %% Node definitions initial_access_rdp[“<b>Action</b> – <b>T1021.001 Remote Services: RDP</b><br/><b>Description</b>: Brute‑force RDP login using NLBrute”] class initial_access_rdp action defense_evasion_impair[“<b>Action</b> – <b>T1562 Impair Defenses</b><br/><b>Description</b>: Disable Windows Defender via disable‑defender.exe and exploit vulnerable drivers”] class defense_evasion_impair action priv_esc_exploit[“<b>Action</b> – <b>T1068 Exploitation for Privilege Escalation</b><br/><b>Description</b>: Leverage CVE‑2017‑0213, CVE‑2018‑8639, CVE‑2021‑41379, CVE‑2016‑0099”] class priv_esc_exploit action discovery_remote[“<b>Action</b> – <b>T1018 Remote System Discovery</b><br/><b>Description</b>: Scan internal network with NetScan, Advanced IP Scanner, Masscan”] class discovery_remote action lateral_movement_rdp[“<b>Action</b> – <b>T1021 Remote Services</b><br/><b>Description</b>: Use stolen credentials for RDP and SMB lateral movement”] class lateral_movement_rdp action credential_dumping[“<b>Action</b> – <b>T1003 OS Credential Dumping</b><br/><b>Description</b>: Extract credentials via Mimikatz, LaZagne, NetPass”] class credential_dumping action execution_vbs[“<b>Action</b> – <b>T1059.005 Visual Basic</b><br/><b>Description</b>: Run VBS script dropped by GuLoader”] class execution_vbs action impact_encrypt[“<b>Action</b> – <b>T1486 Data Encrypted for Impact</b><br/><b>Description</b>: Encrypt files with Makop ransomware encryptor”] class impact_encrypt action %% Connections showing attack flow initial_access_rdp –>|leads_to| defense_evasion_impair defense_evasion_impair –>|leads_to| priv_esc_exploit priv_esc_exploit –>|leads_to| discovery_remote discovery_remote –>|leads_to| lateral_movement_rdp lateral_movement_rdp –>|leads_to| credential_dumping credential_dumping –>|leads_to| execution_vbs execution_vbs –>|leads_to| impact_encrypt “`
Attack Flow
Detections
Makop Ransomware RDP Exploitation and Masscan Usage for Lateral Movement [Windows Network Connection]
View
Detection of ThrottleStop.sys Exploitation for Privilege Escalation [Windows Sysmon]
View
Detection of NLBrute, Mimikatz, and GuLoader Execution [Windows Process Creation]
View
IOCs (HashSha256) to detect: Makop ransomware: GuLoader and privilege escalation in attacks against Indian businesses Part 3
View
IOCs (HashSha256) to detect: Makop ransomware: GuLoader and privilege escalation in attacks against Indian businesses Part 1
View
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
-
Attack Narrative & Commands:
- Preparation:Â The attacker obtains a malicious version ofÂ
ThrottleStop.sys that is instrumented to exploit CVE‑2025‑7771 for privilege escalation. - Deployment: The driver is copied to the system drivers directory (
C:\Windows\System32\drivers). - Execution:Â UsingÂ
sc.exe, the attacker creates and starts a service that loads the malicious driver, thereby elevating the process to SYSTEM. - Post‑escalation: With the elevated token, the attacker can impersonate high‑privilege accounts (T1134.005), but that step is outside the scope of this rule.
- Preparation:Â The attacker obtains a malicious version ofÂ
-
Regression Test Script:
# ---------------------------------------------------------------- # Simulate ThrottleStop.sys exploitation (CVE-2025-7771) # ---------------------------------------------------------------- $driverPath = "$env:SystemRoot\System32\drivers\ThrottleStop.sys" # 1. Drop the malicious driver (here we use a placeholder copy) Write-Host "[*] Copying malicious ThrottleStop.sys to $driverPath" # In a real test, replace the source with the actual malicious binary Copy-Item -Path ".\malicious_ThrottleStop.sys" -Destination $driverPath -Force # 2. Register the driver as a kernel service Write-Host "[*] Creating service for the driver" sc.exe create ThrottleStopSvc binPath= "$driverPath" type= kernel start= demand | Out-Null # 3. Start the driver (triggers Sysmon ImageLoad) Write-Host "[*] Starting the driver service" sc.exe start ThrottleStopSvc | Out-Null Write-Host "[+] Driver loaded – should trigger detection rule." # ---------------------------------------------------------------- -
Cleanup Commands:
# Stop and delete the malicious driver service sc.exe stop ThrottleStopSvc | Out-Null sc.exe delete ThrottleStopSvc | Out-Null # Remove the driver file Remove-Item -Path "$env:SystemRoot\System32\drivers\ThrottleStop.sys" -Force Write-Host "[*] Cleanup complete."