Orexin: New Ransomware Strain Spreads via Network Shares and USB

#cybersecurity #ransomware #malware

Originally published on CyberNetSec.

Executive Summary

Researchers at the cybersecurity firm CYFIRMA have discovered and analyzed a new ransomware strain named Orexin. The malware, identified during routine monitoring of underground forums, targets the Windows operating system. Orexin follows the standard ransomware playbook of encrypting a victim's files and demanding payment for a decryptor. Key characteristics include appending a unique file extension (.orexin), creating a ransom note named HOW_TO_RECOVER.txt, and modifying the desktop wallpaper. A significant technical feature is its built-in capability to propagate to removable media like USB drives and accessible network shares, enabling it to spread beyond the initial point of infection and increasing its potential impact within a victim's environment.

Threat Overview

Orexin is a new addition to the ever-growing landscape of ransomware. While its distribution method and the threat actor behind it are not yet fully understood, its technical capabilities provide insight into its intended operation.

Upon execution, the malware systematically encrypts files on the compromised machine. It then renames the files using a specific pattern: [original_filename]-[id][email].orexin. This pattern includes a victim-specific ID and the attacker's contact email, which is a common method for tracking victims.

The victim is notified of the attack through a text file ransom note (HOW_TO_RECOVER.txt) dropped in affected directories and a modified desktop wallpaper. The note instructs the victim to contact the attackers via email or Telegram to negotiate payment and receive a decryption key. It also includes a common tactic of offering to decrypt one non-valuable file for free to prove their capability.

Technical Analysis

Orexin exhibits several key technical functions typical of modern ransomware:

Encryption: The malware encrypts files on local drives. The specific encryption algorithm used was not detailed in the initial report. This action corresponds to T1486 - Data Encrypted for Impact.
Lateral Spread: A crucial capability is its ability to enumerate and spread to other drives. This includes peripheral and removable media (e.g., USB drives) and mapped network shares. This allows the ransomware to move laterally and encrypt data on other systems accessible from the initially compromised host. This behavior maps to T1135 - Network Share Discovery and subsequent encryption of discovered files.
Victim Notification: The creation of the ransom note and modification of the desktop wallpaper are forms of T1491.001 - Defacement, intended to ensure the victim is aware of the compromise and knows how to contact the attacker.
Inhibit System Recovery: The ransom note warns victims against using third-party recovery tools, a social engineering tactic to prevent recovery and pressure the victim into paying. More advanced ransomware often technically inhibits recovery by deleting volume shadow copies (T1490 - Inhibit System Recovery). It is plausible Orexin does this as well, though not explicitly stated.

Impact Assessment

As a new strain, the full impact of Orexin is not yet known. However, its ability to spread to network shares and removable media poses a significant risk. A single infection on a workstation could quickly escalate to a major incident, encrypting critical files on servers and potentially spreading to other workstations. This could lead to widespread operational disruption, data loss (if backups are not available or are also encrypted), and financial costs associated with recovery and potential ransom payment. The targeting of Windows systems makes it a threat to a vast number of organizations globally.

IOCs — Directly from Articles

Type	Value	Description
file_name	`HOW_TO_RECOVER.txt`	The name of the ransom note dropped by the malware.
file_name	`*.orexin`	The file extension appended to encrypted files.

Cyber Observables — Hunting Hints

Security teams can hunt for the following patterns to detect Orexin activity:
| Type | Value | Description |
|---|---|---|
| file_name | HOW_TO_RECOVER.txt | Use file integrity monitoring (FIM) to alert on the creation of files with this name. |
| command_line_pattern | vssadmin.exe delete shadows /all /quiet | A common command used by ransomware to delete volume shadow copies and inhibit recovery. |
| process_name | wmic.exe shadowcopy delete | An alternative command to delete shadow copies. |
| network_traffic_pattern | Mass file read/write/rename operations on network shares originating from a single endpoint. | This could indicate ransomware spreading from a workstation to a file server. |

Detection & Response

Endpoint Detection and Response (EDR): EDR solutions with behavioral detection capabilities are key to stopping new ransomware strains. Look for alerts related to mass file encryption, deletion of shadow copies, and processes enumerating network shares.
File Integrity Monitoring (FIM): Monitor critical file servers for the creation of files with the .orexin extension or the ransom note HOW_TO_RECOVER.txt.
Honeypots: Place honeypot network shares with fake documents. An alert on any modification to these files can serve as a high-fidelity early warning of ransomware activity.

Mitigation

Backups (M1053): Maintain offline, immutable, and regularly tested backups. This is the most critical defense against any ransomware attack.
Network Segmentation (M1030): Segment networks to prevent lateral movement. Workstations should not have direct, unfettered access to critical servers or other workstations.
Restrict Removable Media: Use policies to control or disable the use of removable media where not required for business purposes (M1034 - Limit Hardware Installation).
Principle of Least Privilege (M1026): Ensure users and service accounts only have access to the network shares and data they absolutely need to perform their roles.