Faust

Faust is a newly discovered variant of the Phobos ransomware, an evolution of the Dharma/Crysis ransomware. It shares similar Tactics, Techniques, and Procedures (TTPs) with other variants such as Elking, Eight, Devos, and Backmydata, indicating a likely connection between them. Researchers from Fortinet’s FortiGuard Labs identified Faust through an Office document containing a Visual Basic for Applications (VBA) script designed to propagate the ransomware. The malware's activities include downloading its payload from a Microsoft Excel document embedded with a VBA script and establishing persistence in compromised IT environments. In early March 2024, organizations across the U.S., including those in healthcare, education, government, and critical infrastructure, were alerted to intrusions involving various Phobos ransomware variants, including Faust. This warning came from the FBI, Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC). Vulnerable remote desktop protocol ports targeted via phishing campaigns have been leveraged by threat actors to gain initial network access and deploy remote access tools. The list of email providers used by Phobos affiliates, including Faust, has also been compiled. These providers include mainstream services like Gmail and Protonmail, as well as more niche or secure services like Tutanota and Mailfence. Additionally, the FBI and CISA noted that the Phobos ransomware operates in conjunction with various open-source tools such as Smokeloader, Cobalt Strike, and Bloodhound, further complicating mitigation efforts.