APT reports

WannaCry and Lazarus Group – the missing link?

A few hours ago, Neel Mehta, a researcher at Google posted a mysterious message on Twitter with the #WannaCryptAttribution hashtag:

The cryptic message in fact refers to a similarity between two samples that have shared code. The two samples Neel refers to in the post are:

  • A WannaCry cryptor sample from February 2017 which looks like a very early variant
  • A Lazarus APT group sample from February 2015

The similarity can be observed in the screenshot below, taken between the two samples, with the shared code highlighted:

So, what does it all mean? Here’s a few questions and answers to think about.

I know about Wannacry, but what is Lazarus?

We wrote about the Lazarus group extensively and presented together with our colleagues from BAE and SWIFT at the Kaspersky Security Analyst Summit (SAS 2017). See:

Among other things, the Lazarus group was responsible for the Sony Wiper attack, the Bangladesh bank heist and the DarkSeoul operation.

We believe Lazarus is not just “yet another APT actor”. The scale of the Lazarus operations is shocking. The group has been very active since 2011 and was originally disclosed when Novetta published the results of its Operation Blockbuster research. During that research, which we also participated in, hundreds of samples were collected and show that Lazarus is operating a malware factory that produces new samples via multiple independent conveyors.

Is it possible this is a false flag?

In theory anything is possible, considering the 2015 backdoor code might have been copied by the Wannacry sample from February 2017. However, this code appears to have been removed from later versions. The February 2017 sample appears to be a very early variant of the Wannacry encryptor. We believe a theory a false flag although possible, is improbable.

What conclusions can we make?

For now, more research is required into older versions of Wannacry. We believe this might hold the key to solve some of the mysteries around this attack. One thing is for sure — Neel Mehta’s discovery is the most significant clue to date regarding the origins of Wannacry.

Are we sure the early February variant is the precursor to the later attacks?

Yes, it shares the same the list file extension targets for encryption but, in the May 2017 versions, more extensions were added:

> .accdb
> .asm
> .backup
> .bat
> .bz2
> .cmd
> .der
> .djvu
> .dwg
> .iso
> .onetoc2
> .pfx
> .ps1
> .sldm
> .sldx
> .snt
> .sti
> .svg
> .sxi
> .vbs
> .vcd

They also removed an older extension: “.tar.bz2” and replaced it with just “.bz2”
We strongly believe the February 2017 sample was compiled by the same people, or by people with access to the same sourcecode as the May 2017 Wannacry encryptor used in the May 11th wave of attacks.

So. Now what?

We believe it’s important that other researchers around the world investigate these similarities and attempt to discover more facts about the origin of Wannacry. Looking back to the Bangladesh attack, in the early days, there were very few facts linking them to the Lazarus group. In time, more evidence appeared and allowed us, and others, to link them together with high confidence. Further research can be crucial to connecting the dots.

Has anyone else confirmed this?

Yes, Matt Suiche from Comae Technologies confirmed the same similarity based on Neel’s samples:

Can you share the YARA rule used to find this?

Yes, of course.

You can download the “lazaruswannacry” Yara rule here.

Also included below for easy reading:

WannaCry and Lazarus Group – the missing link?

Your email address will not be published. Required fields are marked *

 

  1. Kiers

    When Wcry encrypts all those computer files across the world, are the DECRYPTION KEYS THE SAME for all those computers? if NOT, then how do the criminals know which key to assign to which ransomee?

    1. A

      Each computers has it’s own ID that the user sends to the hackers.

    2. LKH

      The keys are unique to each computer hit. Traditionally they are generated locally, sent to a dump account somewhere, and then deleted locally, from where the criminals can pull the relevant key and send it. Usually however they don’t bother sending the keys once you pay.

    3. Toaster

      Decryption key is different for every victim. The identity of each infected device is either stored in the C2, in case of online encryption, or a file is generated which is synchronized with the remote server during the payment process. Hope that helped.

      1. Toaster

        Moreover, if the decryption key was same for each victim then ransom payment by just one victim would result in every victim’s file being decrypted. That would be grave problem for ransomware authors and anti-malware solutions alike.

  2. hasin najafi

    As i see infected system in Iran it’s use random number for kind of this.
    make thumb up to some clever ppl make this kind of worm for stupid boo0os that event know simple protocol.

  3. TCorp

    $a string has clear text value:
    /0123456789?@ADEFbcdfghijk

    May be a password

    1. Jonathan James

      TCorp: Looks like a regex-string

  4. RockBrentwood

    The string has 26 characters in it.

Reports

How to catch a wild triangle

How Kaspersky researchers obtained all stages of the Operation Triangulation campaign targeting iPhones and iPads, including zero-day exploits, validators, TriangleDB implant and additional modules.

Subscribe to our weekly e-mails

The hottest research right in your inbox