Ransomware - MalasLocker

The name “MalasLocker” is derived from the double extortion website and the operator’s email address to communicate with victims. The double extortion page headline says: "Somos malas... podemos ser peores," which is Spanish and translates to English as “We are bad… We could be worse.” The email they use is the same, but in email format - somos.malas.podemos.ser.peores@protonmail[.]com. For brevity, some researchers call it “Malas,” which means “bad” or “evil” in English.

A lot about this ransomware is unique relative to what is usually observed. For example, the first known activities from this group date back to April 9th, 2023, when they posted a list of 169 “defaulters” and three other organizations, a lot of victims to post to begin operations. The 169 defaulters were a list of companies with hyperlinks to a text file containing their server configurations and a statement saying that these companies didn’t “fulfill their obligations.” This could mean that negotiations began, and they didn’t honor them, or they most likely didn’t pay the initial ransom. On that topic, the ransom demanded from the MalasLocker group is a donation to a charity they approve of. The list of charities they approve of is unknown, but the ransom differs from the norm. The ransom aligns with the group’s motive, which appears to be hacktivist-driven based on the fact that the front of the double extortion page is a long manifesto about class warfare and how “ransomware brings out humanity in an inhumane system.”

A few days before the 172 extortions were posted to their page, users in the BleepingComputer and Zimbra forums began reporting problems with their servers. These forum entries provide much insight into what happens because the WatchGuard Threat Lab could not find a payload sample. If you’re wondering why users in Zimbra were reporting server errors, it’s because the group targeted Zimbra servers in their initial attacks. Zimbra is an open-source email collaboration toolset used by people worldwide.

Information from the attacks points to various JavaServer Pages (.jsp) found in the path: /opt/zimbra/jetty_base/webapps/zimbra/ and its subfolders. The JSP files with names like heartbeat.jsp, info.jsp, and noops.jsp, among others, were found in the logs of some victims in early February 2023. These JSP files were reverse shells that allowed the attackers to lay dormant on the machines for a while and strike when they were ready. Interestingly, one of the tools they used before attacking was the open-source tool Fuzz Faster U Fool (ffuf), which is a web fuzz tool written in GoLang. After information was gathered, files on the servers were encrypted with an encryption method rarely seen called “age.” This encryption tool was created by the Go security lead at Google and uses a combination of various algorithms, including X25519, ChaChar20-Poly1305, and HMAC (SHA256).

This ransomware is another example of how some groups aren’t only financially motivated, but some have other intentions. Nevertheless, the intentions always include malicious and illegal actions.