Blackwell Helix Threat Bulletin: Helldown Ransomware Targets VMware Processes on Linux

By: Bryan Zatezalo, Seth Feldman

December 11, 2024

Key Alert:

Helldown ransomware, a rising threat in 2024, has been observed exploiting a vulnerability in Zyxel firewalls to gain network access and disable VMware processes, allowing encryption of Linux systems. This threat poses critical risks to healthcare organizations reliant on virtualized infrastructures.

Threat Overview:

Helldown has emerged as a notable ransomware group. It focuses its attacks on Linux environments, particularly VMware ESX servers. By shutting down critical VMware processes, the ransomware enables the encryption of virtualized systems. The group leverages vulnerabilities in widely used network appliances as its primary entry vector, making unpatched systems especially vulnerable.

Key aspects of Helldown include:

Volume of Data Stolen: An average of 70GB per attack, with individual incidents ranging from 22GB to 431GB.
Indiscriminate Targeting: Unlike more selective groups, Helldown targets entire network shares and NAS systems, prioritizing disruption over precision.
Evolving Capabilities: While still developing its Linux attack vectors, the group has shown consistent improvements in exploiting vulnerabilities and deploying effective ransomware variants.

Healthcare Impacts:

Healthcare organizations are particularly vulnerable to Helldown ransomware due to their reliance on virtualized systems and the critical nature of the data involved. Specific impacts include:

Operational Disruption: Shutting down VMware processes compromises access to electronic health records (EHR) and other critical applications, delaying patient care.
Data Breaches: Double extortion tactics mean stolen data, including sensitive patient information, could be publicly leaked if ransom demands are unmet.
Regulatory and Compliance Risks: Exposure of protected health information (PHI) risks violations of HIPAA and other regulatory frameworks.

Exploitation Method:

Helldown uses CVE-2024-42057, a command injection vulnerability in the IPSec VPN feature of certain Zyxel firewalls. This vulnerability allows unauthenticated attackers to execute arbitrary commands by sending a specially crafted username.

Affected Zyxel Products and Firmware Versions:

ATP Series: Firmware V4.32–V5.38
USG FLEX Series: Firmware V4.50–V5.38
USG FLEX 50(W) Series: Firmware V4.16–V5.38
USG20(W)-VPN Series: Firmware V4.16–V5.38

Note: Devices operating in Nebula cloud management mode are not affected, as stated by Zyxel here.

Indicators of Compromise (IoCs):

These IOCs, in the format of SHA256 hashes, provide crucial artifacts for detecting potential breaches and understanding the tools and techniques employed by the threat group.

Helldown Windows Payloads:

0bfe25de8c46834e9a7c216f99057d855e272eafafdfef98a6012cecbbdcfab
7cd7c04c62d2a8b4697ceebbe7dd95c910d687e4a6989c1d839117e55c1cafd7
7731d73e048a351205615821b90ed4f2507abc65acf4d6fe30ecdb211f0b0872
3e3fad9888856ce195c9c239ad014074f687ba288c78ef26660be93ddd97289e

Helldown Windows Icons, Ransom Notes, and Scripts:

2621c5c7e1c12560c6062fdf2eeeb815de4ce3856376022a1a9f8421b4bae8e1
47635e2cf9d41cab4b73f2a37e6a59a7de29428b75a7b4481205aee4330d4d19
cb48e4298b216ae532cfd3c89c8f2cbd1e32bb402866d2c81682c6671aa4f8ea
67aea3de7ab23b72e02347cbf6514f28fb726d313e62934b5de6d154215ee733
2b15e09b98bc2835a4430c4560d3f5b25011141c9efa4331f66e9a707e2a23c0 (Overlaps with Darkrace and Donex malware families according to Sekoia)

Helldown Linux Payload:

6ef9a0b6301d737763f6c59ae6d5b3be4cf38941a69517be0f069d0a35f394dd

Helldown Linux Ransom Note:

9ab19741ac36e198fb2fd912620bf320aa7fdeeeb8d4a9e956f3eb3d2092c92c

Zyxel Compromise Artifact (zzz1.conf):

ccd78d3eba6c53959835c6407d81262d3094e8d06bf2712fefa4b04baadd4bfe

Tactics, Techniques, and Procedures (TTPs):

Tactics	Techniques
Resource Development	T1650 – Acquire Access
Initial Access	T0819 – Exploit Public-Facing Application
Discovery	T1087.001 – Local Account
Impact	T1471 – Data Encrypted for Impact
Initial Access	T0866 – Exploitation of Remote Services

Recommendations for Healthcare Organizations:

Blackwell Security MHXDR Customers:

Blackwell actively conducts threat hunting within the logs and telemetry we collect for our clients. We have already begun hunting for IoCs and TTPs derived from our Helix threat operations team. If you are an MHXDR subscriber, please refer to your signal lifecycles for any suspected issues or alarms that require your attention.

Immediate Actions:

Patch Zyxel Devices: Update all affected firmware versions immediately to mitigate vulnerabilities.
Review Logs: Monitor for IoCs and suspicious activity indicative of Helldown presence.
Backup Systems: Maintain secure, offline backups of critical data and configurations.

Long-Term Defense:

Network Segmentation: Isolate critical infrastructure to minimize lateral movement.
Enhanced Monitoring: Deploy advanced threat detection focused on VMware and Linux environments.
Access Controls: Strengthen identity and access management by enforcing multi-factor authentication and minimizing admin privileges.

Leadership Guidance:

Conduct risk assessments to identify and remediate vulnerabilities in virtualized and networked environments.
Invest in staff training to reduce the likelihood of successful social engineering attempts.
Partner with Blackwell Security and leverage Pulse and Helix products for managed detection and response services tailored to healthcare organizations’ unique challenges.

References:

Blackwell Helix continues to monitor Helldown activity and provides healthcare organizations with tailored solutions to mitigate ransomware risks. For more information, contact Blackwell Security’s threat operations team.

Annual HIPAA Security Risk Assessment: Key Requirements and Deadlines

Healthcare Regulations

December 15, 2024

Blackwell is cybersecurity made for healthcare.

Our comprehensive security platform and expert managed services provide the most complete protection for healthcare organizations. Leading providers across North America trust Blackwell to reduce cyber risk, stay compliant, and build trusted experiences across the care continuum.