Netwalker

NetWalker is a highly profitable ransomware kit, known for its ability to disable antivirus software on Windows 10 systems and encrypt files, adding a random extension to the encrypted ones. Once executed, it disrupts operations and can even hold data hostage for ransom. It has been observed that NetWalker often infiltrates systems through suspicious downloads, emails, or websites, notably through an attachment that allegedly contains information about COVID-19. This file, named “CORONAVIRUS_COVID-19.vbs”, embeds a NetWalker ransomware executable and obfuscated code to extract and launch this ransomware on the victim’s computer. Spain has been identified as a hotspot for infections from this malware. The malware has been linked with various threat actors and affiliates such as Bentley, Cherry, and Zeus, who have been delivering crypted malware samples. Notably, "zevs" ("zeus") is associated with the prominent distribution group Hive0106 (aka TA551), which used the gtags ‘zev,’ ‘zem’ and ‘zvs’ during their Trickbot campaigns. Some of these campaigns may be delivered by threat actors using the handles 'Netwalker' and 'Cherry,' believed to be working within the ITG23 organization. In addition, other types of ransomware like SunCrypt have adopted attacking techniques from NetWalker and Maze ransomware. In response to the widespread NetWalker ransomware attacks, particularly those targeting vulnerable Pulse Secure VPN devices for initial access, the FBI released Indicators of Compromise (IOCs) in July 2020. The Department of Justice also launched global action against NetWalker Ransomware to counteract its harmful effects. Despite these measures, NetWalker remains a significant threat due to its sophisticated techniques and high profitability.