Adhubllka

Adhubllka is a malware that has been active since at least 2019, but it gained more attention in January 2020. It has been used by threat group TA547 in campaigns targeting various sectors of Australia in 2020. Over the years, many samples of Adhubllka have been misclassified or mistagged into other ransomware families, according to Rakesh Krishnan, senior threat analyst at Netenrich. This confusion has been compounded by the fact that other names, including ReadMe, MMM, MME, and GlobeImposter2.0, have been assigned to the same piece of malware, all of which actually belong to the Adhubllka ransomware family. Two new variants of Adhubllka, TZW and U2K, were identified by researchers from security and operations analytics firm Netenrich. These variants were distinguishable by a unique sentence in their ransom note: "the server with your decryptor is in a closed network Tor." Other clues included the campaign's use of an email address reported widely as belonging to the ransomware group, and its link to the MD5 variant sample of Adhubllka spotted in 2019. Researchers tracked previously linked Tor domains used by the actor, uncovering clues within the ransom note dropped to victims to trace it back to the source. Despite its activity, identifying TZW as a spinoff of Adhubllka was challenging due to the relatively small ransom demands typically made by the group, ranging from $800 to $1,600. However, researchers anticipate that this ransomware may grow bigger over time, as updates have been made on its infrastructure. In the future, this ransomware may be rebranded with other names, and other groups may also use it to launch their own ransomware campaigns.