Ransomware Tracker (Entry #231): WAGNER
Entry: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/wagner-0
WAGNER ransomware claims to be the "official virus of PMC Wagner on employment." PMC stands for Private Military Company, and Wagner is a PMC backed by the Russian government. They are more commonly referred to as the Wagner Group. On February 24, 2022, Russia invaded Ukraine, and Russia's president, Vladimir Putin, called it a special military operation (SMO). In addition to Russian military forces, the Wagner Group was intertwined in this invasion. Several months after Ukraine defiantly thwarted the invasion to a grinding stalemate, primarily on Ukraine's Eastern front, Wagner's leader, Yevgeny Prigozhin, published video after video of the situation in the frontlines, Eventually, he persistently complained about the lack of ammunition and casualties because of it, which he blamed on Russia's leadership, mainly the Minister of Defence, Sergei Shoigu, and Chief of the General Staff, Valery Gerasimov.
On Friday, June 23, 2022, Prigozhin threatened a rebellion against Russian leadership and began a march on Moscow with members of the Wagner Group. Two days later, this ransomware was created (based on the compilation timestamp) using the Chaos v4.0 builder while the march toward Moscow was ongoing. Given that it was created during the rebellion and the first upload of the only known sample came from Russia, it's logical to assume it was designed to sow further Chaos (no pun intended) from the Ukranian point of view. Encrypting someone's files and enticing them to "go to war against Shoigu" aren't the most effective ways to recruit Russian nationals to rise up against their own government. However, this is all conjecture and educated guesses based on the limited information about this ransomware.
Aside from the backstory, the technical information is more straightforward. The encryption information and behaviors are already understood because the executable is built using Chaos v4.0. We know it's the Chaos v4.0 builder instead of any other version because the functions match what an executable would have if built from this version; they match one-to-one. Therefore, the encryption algorithm uses AES-256-CBC to encrypt the files and RSA-1024 to encrypt the AES symmetric key. Any files over 2 MB are overwritten and can not be recovered. It's worth noting that Truesec created a decryptor for Chaos-created ransomware for files less than 2 MB.
Based on all the information provided, it's safe to assume that the threat actor had no intention of decrypting files or collecting a ransom. As such, we've labeled the extortion type as 'pseudo-extortion.'
