Behind Enemy Lines: Engaging and Disrupting Ransomware Web Panels

Behind Enemy Lines: Engaging and Disrupting Ransomware Web Panels

Speakers: Vagelis, CTO & Co-founder, Atropos

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=-Xh5M_4DXFY

Overview

In "Behind Enemy Lines: Engaging and Disrupting Ransomware Web Panels," Vagelis, CTO and co-founder of Atropos, delivers a raw and candid exploration into the challenging world of actively probing and compromising the command and control (C2) infrastructure of ransomware groups. Drawing from his extensive background as a security researcher with a decade of experience in API, IoT, and malware C2 analysis, Vagelis shares his journey from successfully disrupting general malware operations to confronting the significantly more formidable adversary that is modern ransomware. The talk, playfully rated PG17 for its unfiltered language, serves as a testament to the tenacity required to operate on the front lines of cyber threat intelligence.

This presentation delves into the inherent difficulties and occasional triumphs of penetrating the backend systems that power multi-billion dollar ransomware operations. Vagelis highlights the stark contrast in success rates between traditional malware C2s and ransomware panels, underscoring the professionalization and enhanced security posture of the latter. His research, spurred by a personal challenge from fellow elite hackers, provides a rare glimpse into the methodologies and specific vulnerabilities discovered within active ransomware infrastructure, offering invaluable insights for both offensive security practitioners and defensive strategists striving to mitigate this pervasive threat.

The significance of this research cannot be overstated. With ransomware payouts exceeding $1.1 billion in 2023 and attacks increasingly targeting critical national infrastructure and healthcare, understanding and disrupting these operations is paramount. Vagelis's work exemplifies the "wild west" nature of cyber threat intelligence, where dedicated individuals can uncover critical weaknesses in even the most sophisticated criminal enterprises. By dissecting the vulnerabilities found in specific ransomware groups, the talk provides concrete examples of how proactive engagement can yield intelligence that empowers defenders and potentially disrupts the extortion cycle.

Background

▶ Watch: Introduction, speaker's background, and talk rating (0:00)

The speaker's foray into ransomware disruption was a natural progression from his prior success in compromising conventional malware Command and Control (C2) panels. In previous research, Vagelis demonstrated a remarkable success rate, managing to "pawn" or gain access to the source code of approximately 50% of the malware panels he targeted – specifically, 18 out of 36 observed panels. This level of access provided deep insights into the operational mechanics of various malware families, allowing for comprehensive analysis and the development of effective countermeasures. However, driven by a desire for a "bigger challenge," and reportedly encouraged by a Signal chat group including friends and renowned security researchers Felipe Solferini, Iskuri one, and no thanks, Vagelis set his sights on the more complex and lucrative world of ransomware.

The shift to ransomware C2s presented a stark reality check. Despite his previous high success rate, Vagelis found ransomware panels to be significantly more resilient. Out of 140 ransomware panels investigated, he managed to find "something" on only "three and a half," illustrating the enhanced security, operational sophistication, and perhaps the sheer scale of resources invested by ransomware groups. This difficulty underscores the nature of the problem: ransomware is no longer the domain of amateur hackers but a highly professionalized, fast-growing cybercrime industry.

The ransomware market, as highlighted by Vagelis, is a formidable economic force. Payouts in 2023 alone surged past the psychological barrier of $1 billion, reaching an estimated $1.1 billion. This immense profitability fuels continuous investment in sophisticated tools, infrastructure, and operational security, making these groups exceptionally difficult to penetrate. The speaker emphasizes that these are "highly professional" adversaries, often demonstrating advanced tradecraft comparable to state-sponsored APTs. Their targets have also expanded, moving beyond traditional corporate networks to include critical national infrastructure, hospitals, and virtually any entity capable of paying a ransom, a trend notably exacerbated since events like the WannaCry outbreak.

Ransomware operations typically follow a multi-stage lifecycle:

1. Malware Distribution and Infection: Initial compromise of target systems through various vectors (phishing, exploiting vulnerabilities, supply chain attacks).
2. Command and Control (C2): Establishing persistent communication between the infected system and the attacker's infrastructure to manage the attack.
3. Discovery and Lateral Movement: Exploring the compromised network to identify valuable assets, sensitive data, and expand their foothold.
4. Data Extraction: Exfiltrating sensitive data, often as a secondary extortion tactic (double extortion).
5. Data Encryption: Encrypting files and systems, rendering them inaccessible to the victim.
6. Extortion: Presenting a ransom note, demanding payment (typically in cryptocurrency) by a deadline, often threatening data destruction or public release if not met.
7. Resolution: The final step, where victims either pay the ransom to attempt decryption, recover from backups, or face permanent data loss.

Vagelis's research specifically targets the C2 and extortion phases, aiming to disrupt the very web panels that facilitate communication with victims and manage the malicious operations. His work aligns with the broader cyber threat intelligence (CTI) community's efforts to gain insights into adversary infrastructure, tactics, techniques, and procedures (TTPs) to better inform defensive strategies and potentially aid in law enforcement efforts.

Key Findings

▶ Watch: Initial low success rate in ransomware panel research (3:25)

The central revelation from Vagelis's research is the stark contrast in the security posture between general malware C2 panels and those operated by sophisticated ransomware groups. While he achieved a 50% success rate in compromising 36 general malware C2s, his efforts against 140 ransomware panels yielded actionable insights on only 3.5 of them. This demonstrates that ransomware operators, driven by significant financial incentives, have invested heavily in securing their infrastructure, making them a much tougher target for researchers seeking to "engage and disrupt."

Despite this formidable challenge, Vagelis successfully identified a critical vulnerability within the web panel of the Mallox ransomware group, also known by aliases such as Target Company, Fargo, and Tonichi. Mallox, first observed in June 2021, primarily targets Windows machines and is known for exploiting Microsoft SQL Server instances, initially through brute-forcing SA accounts and more recently by leveraging zero-day vulnerabilities. The group has claimed hundreds of victims, showcasing its active and impactful operations.

The key finding related to Mallox was the exposure of a server status endpoint on their web panel. This endpoint, which should have been secured or restricted, was found to be leaking sensitive operational data. Specifically, it was directly exposing:

• URLs associated with the ransomware group's infrastructure.
• Server IP addresses, revealing the physical or virtual locations of their C2 servers.
• Tokens that could be used to access and check other victims' private messages within the Mallox chat portal.

This vulnerability provided Vagelis with an unprecedented level of visibility into Mallox's operations. The leaked URLs and IP addresses offer crucial intelligence for tracking and potentially disrupting the group's infrastructure. More strikingly, the exposed tokens allowed the researcher to bypass authentication mechanisms and directly view private conversations between Mallox operators and their victims. This capability not only provides deep insight into the negotiation tactics and demands of the ransomware group but also exposes the sensitive communications of affected organizations, highlighting a significant operational security failure on the part of Mallox.

The implication of this finding is profound: even highly professional and financially motivated ransomware groups, despite their advanced offensive capabilities, can fall prey to fundamental web application security misconfigurations. This demonstrates that continuous vigilance and thorough security audits are critical, even for threat actors themselves. For defenders and CTI analysts, it underscores the potential for disrupting ransomware operations by actively probing their public-facing infrastructure for such vulnerabilities, offering a glimmer of hope in the fight against this pervasive threat.

Technical Deep Dive

▶ Watch: Fundamental explanation of ransomware and its operational steps (3:45)

The technical core of Vagelis's presentation revolves around the specific vulnerabilities identified within the Mallox ransomware group's web panel. Mallox, a prominent ransomware variant that emerged in June 2021, has established a significant footprint, primarily targeting Windows environments. Its initial infection vectors frequently involved exploiting Microsoft SQL Server instances, often through brute-forcing SA (system administrator) accounts, indicating a reliance on common administrative weaknesses. More recently, the group has evolved to incorporate zero-day exploits into its arsenal, demonstrating an adaptive and sophisticated approach to initial access.

The typical interaction model for Mallox victims involves navigating to a dedicated "private site name" (their victim portal) where they are prompted for a private key to log in and initiate a chat with the ransomware operators. This private key is usually found within the ransom note left on encrypted systems, acting as a unique identifier for the victim's case. The chat interface is where negotiations occur, ransom demands are communicated, and proof of decryption (e.g., decrypting a small sample file) is often exchanged.

Vagelis's methodology for uncovering vulnerabilities involved a combination of reactive and proactive techniques. After "infecting something and said hello" – implying a controlled environment where the ransomware was triggered to generate a ransom note and thus reveal the victim portal – he then employed FFUF (Ffuf is a fast web fuzzer written in Go). FFUF is a powerful tool for discovering hidden files and directories, virtual hosts, and other endpoints on web servers through brute-forcing paths and parameters. It was through extensive fuzzing with FFUF that Vagelis identified an exposed endpoint on the Mallox web panel: a /server_status or similarly named page.

This /server_status endpoint was critically misconfigured, lacking proper authentication or access controls. When accessed, it did not merely return a simple "OK" status but instead leaked a wealth of sensitive operational data. The information exposed included:

1. URLs: The endpoint revealed internal or related external URLs used by the Mallox infrastructure. These could point to other C2 servers, data exfiltration points, staging servers, or administrative interfaces. Gaining access to these URLs provides a roadmap of the adversary's network topology and potential avenues for further investigation or disruption.
2. Server IP Addresses: Crucially, the endpoint exposed the actual IP addresses of the servers hosting the Mallox infrastructure. This information is invaluable for CTI teams, allowing them to:

• Identify the hosting providers used by the ransomware group.
• Track the geographical locations of their servers.
• Correlate these IPs with other known malicious activity.
• Initiate takedown requests or sinkholing operations with hosting providers, though this is often a complex and legally fraught process.

1. Tokens to Check Other People Messages: Perhaps the most impactful technical finding was the leakage of authentication tokens. These tokens, likely session tokens or API keys, were designed to allow victims to securely access their private chat sessions with Mallox operators. However, because they were exposed on the /server_status page, Vagelis was able to harvest them. With these tokens, he could then impersonate other victims, gaining unauthorized access to their individual chat threads. This allowed him to read the ongoing ransom negotiations, observe the tactics employed by the Mallox operators, and understand the specific demands and deadlines imposed on various victims. This level of access provided a real-time, unvarnished look "behind enemy lines," offering unparalleled intelligence into the ransomware group's operational tempo and victim interaction strategies.

The vulnerability was not complex in nature but rather a fundamental lapse in web server configuration and access control. It highlights that even highly motivated and technically proficient criminal enterprises can overlook basic security hygiene, especially in infrastructure components that might be perceived as less critical than the core malware itself. The use of a simple fuzzing tool like FFUF to uncover such a critical information leak underscores the power of persistent, automated reconnaissance in identifying exploitable weaknesses in adversary infrastructure.

Demo / Proof of Concept

▶ Watch: First ransomware case study: Mallox overview and targets (5:55)

While the talk did not feature a live, real-time demonstration of the compromise, Vagelis provided a clear and compelling description of the proof-of-concept (PoC) that validated his findings against the Mallox ransomware group's web panel. The PoC directly leveraged the misconfigured /server_status endpoint to gain unauthorized access and insight into active ransomware operations.

The process began with the speaker's initial reconnaissance, which involved causing an infection in a controlled environment to obtain a sample ransom note. This note would have contained the specific URL of the Mallox victim portal and the unique private key required to access a victim's dedicated chat session. With this initial access point identified, Vagelis then employed the FFUF (Ffuf is a fast web fuzzer written in Go) tool. FFUF was used to systematically probe the Mallox web server for unindexed directories, hidden files, and exposed API endpoints. This brute-forcing technique eventually led to the discovery of the unsecured /server_status endpoint.

Upon accessing this endpoint, the PoC revealed the critical information leak: the page was openly displaying URLs related to Mallox's broader infrastructure, server IP addresses of their C2 nodes, and, most significantly, authentication tokens belonging to other active victims. These tokens were evidently intended for internal use or for legitimate victim sessions but were inadvertently exposed to anyone who could access the /server_status page.

The core of the PoC, as described by Vagelis, was the ability to utilize these leaked tokens. By injecting these tokens into his own requests or session, he could effectively impersonate other victims. This allowed him to bypass the private key authentication mechanism and directly access the chat logs of other compromised organizations. He explicitly stated, "So I could see others people messages, but that was not fun enough," indicating that he had indeed successfully viewed these sensitive communications. This demonstrated direct, unauthorized access to ongoing ransom negotiations, providing a unique vantage point into the attackers' demands, deadlines, and communication strategies with their victims.

Although not a step-by-step live hack, the speaker's account clearly functions as a proof of concept. It detailed the discovery method (FFUF), the specific vulnerability (exposed /server_status leaking tokens), and the direct impact (accessing other victims' chat messages). This validated the existence of a significant operational security flaw in the Mallox ransomware infrastructure, providing actionable intelligence and demonstrating a tangible method for researchers to "engage" with and gain insight into these criminal operations.

Defensive Implications

▶ Watch: Critical vulnerability found in Mallox web panel (6:35)

The findings presented by Vagelis, though stemming from offensive research, carry profound defensive implications for both organizations seeking to protect themselves from ransomware and the broader cybersecurity community engaged in threat intelligence and disruption efforts.

For organizations and network defenders, the primary takeaway is the critical importance of foundational security hygiene, even in the face of sophisticated adversaries. While Mallox exploits MS SQL and sometimes zero-days for initial access, the web panel vulnerability was a basic misconfiguration. This highlights:

• Comprehensive Web Application Security: All public-facing web applications, including those seemingly benign (like status pages), must undergo rigorous security audits, penetration testing, and continuous monitoring. Strict authentication and authorization must be applied to all endpoints, not just login pages.
• API Security: The leakage of tokens underscores the need for robust API security practices. Tokens should have limited lifespans, be scope-restricted, and never be exposed in unsecured endpoints. Implement strong session management and token invalidation mechanisms.
• Proactive Vulnerability Management: Regularly scan and fuzz your own external-facing infrastructure using tools like FFUF to identify inadvertently exposed pages, misconfigurations, or information leaks before adversaries do.
• Supply Chain Security: Given that ransomware operators themselves can have security flaws, organizations should consider the security posture of any third-party services they rely on, as a compromise upstream could impact them.

For the cyber threat intelligence (CTI) community and law enforcement, Vagelis's work provides a compelling case for proactive, offensive-minded research into ransomware infrastructure:

• Active Reconnaissance: The success against Mallox demonstrates that persistent scanning and fuzzing of known ransomware C2 IP addresses and domains can yield significant intelligence. This includes identifying exposed endpoints, administrative interfaces, or misconfigured APIs.
• Infrastructure Takedown Opportunities: Leaked IP addresses and URLs provide vital data for coordinating with hosting providers or law enforcement agencies for potential infrastructure takedowns or sinkholing operations, thereby disrupting the ransomware's ability to communicate with victims or exfiltrate data.
• Understanding Adversary TTPs: Gaining access to victim chats offers unparalleled insights into the specific negotiation tactics, ransom demands, payment mechanisms, and even the technical support (or lack thereof) provided by ransomware operators. This intelligence can inform incident response playbooks and victim guidance.
• Intelligence Sharing: Findings like these, when appropriately shared within trusted CTI circles, can contribute to a collective defense. Knowing the vulnerabilities in one ransomware group might hint at similar weaknesses in others, or inform the development of tools to detect such exposures more broadly.
• Challenges of Attribution and Legality: It's important to acknowledge the legal and ethical complexities involved in "engaging" with criminal infrastructure. While the speaker's intent is clearly defensive, such actions often operate in a grey area, necessitating careful consideration and, ideally, coordination with legal counsel or relevant authorities.

In essence, Vagelis's research serves as a stark reminder that even the most formidable cyber adversaries are not infallible. Their operational security, while often superior to that of general malware groups, can still be undermined by basic errors. By understanding these vulnerabilities, defenders can refine their strategies, not only to protect against initial infection but also to actively disrupt the post-exploitation phases of a ransomware attack, potentially saving organizations from significant financial and reputational damage.

Key Takeaways

• Ransomware C2 panels are significantly more challenging to compromise than general malware C2s, reflecting the high professionalization and financial backing of modern ransomware groups (3.5 successes out of 140 attempts compared to 18 out of 36 for malware).
• Despite their sophistication, even prominent ransomware groups like Mallox can exhibit critical web application security flaws, such as exposed server status endpoints.
• Proactive reconnaissance using fuzzing tools like FFUF can effectively uncover hidden or misconfigured web endpoints on adversary infrastructure.
• Leaked information from these endpoints, including URLs, server IP addresses, and especially authentication tokens, provides invaluable intelligence for tracking, disrupting, and understanding ransomware operations.
• Accessing leaked tokens can allow unauthorized viewing of sensitive victim-operator chat logs, offering real-time insights into negotiation tactics and operational security failures.
• Defenders should prioritize comprehensive web application and API security audits for all public-facing assets and consider proactive monitoring of adversary infrastructure to identify similar vulnerabilities.

About the Speaker(s)

The primary speaker for this talk is Vagelis, who identifies himself as the CTO and co-founder of Atropos. Atropos is a company specializing in penetration testing across various sectors, including energy, green energy, EV (Electric Vehicles), and PV (Photovoltaics), among others. Vagelis has a robust background as a security researcher, having dedicated the past 10 years to the field. His main interests lie in the security of APIs, IoT (Internet of Things) devices, and, more recently, Command and Control (C2) infrastructure for both general malware and ransomware.

Vagelis explicitly mentions a collaborative effort with three other individuals who "poked" him to pursue ransomware research:

• Felipe Solferini: Described as a "really good friend and partner in pretty much all my research," and the person Vagelis "constantly blaming" for his endeavors.
• Iskuri one: A "legend in boot loaders" and a multiple-time speaker at prestigious conferences like Black Hat and Defcon.
• no thanks: Characterized as a "ninja hacker" and an "elite world renowned artist," also a multiple-time Defcon speaker.

This collective of experienced security researchers and hackers played a significant role in motivating Vagelis to tackle the formidable challenge of engaging with ransomware web panels.