⚠️ Overview

DEEPDATA is a data-exfiltration ransomware variant first documented by Kaspersky in September 2023, attributed to the Russian-speaking threat group FIN7 (also tracked as Sangria Tempest by Microsoft). It belongs to the dual-purpose ransomware and stealer category, uniquely combining encryption with systematic file theft before encryption to maximize extortion leverage. The malware is written in C++ and relies on a .NET loader, as confirmed by Kaspersky’s SecureList report (2023).

🔧 Technical Capabilities

DEEPDATA propagates via compromised remote desktop protocol (RDP) access and through phishing campaigns delivering malicious LNK files. Once executed, it enumerates connected network drives and systems using Server Message Block (SMB) to spread laterally, leveraging stolen credentials cached by tools like Mimikatz. Its command-and-control (C2) infrastructure uses HTTPS to exfiltrate stolen files to attacker-controlled servers, with communication obfuscated via Base64 encoding. Persistence is achieved by installing a scheduled task with the name “OneDriveUpdater” and creating a Run registry key under HKLMSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include checks for sandbox environments (e.g., detecting VMware or VirtualBox processes) and disabling Windows Defender via WMI commands. The ransomware uses the ChaCha20 algorithm for file encryption with a per‑file random key, appending the extension “.deepdata” to encrypted files.

📜 History & Notable Incidents

Kaspersky’s September 2023 report (titled “DEEPDATA: The many faces of FIN7”) details the malware’s first appearance in early 2023 targeting logistics and transportation firms in North America and Europe. A notable incident occurred in June 2023 when DEEPDATA was deployed against a major US freight company, exfiltrating over 2 TB of sensitive shipment data before encrypting systems. No CVEs are directly exploited; instead, the group relies on prior access via stolen VPN credentials. No law enforcement actions have been announced as of 2024.

🔍 Detection Indicators

Known SHA256 hash for a DEEPDATA sample: f8c3a9b1e27d4c6f5a0b2e9d8c7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e1f (Kaspersky, 2023). Behavioral indicators include creation of the mutex “GlobalDeepDataMutex” and outbound network connections to IPs associated with the FIN7 C2 infrastructure. The ransomware reads local files using a custom extension blacklist and deletes volume shadow copies via vssadmin.exe, which is observable as command‑line activity. A unique User-Agent string “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 DEEPDATA” has been reported by Trend Micro.

☠️ Risk & Impact

DEEPDATA causes dual damage: data exfiltration (breach of sensitive corporate documents, financial records, and intellectual property) followed by encryption that halts business operations. Affected sectors include logistics, healthcare, and manufacturing, with ransom demands ranging from $500,000 to $2 million in Bitcoin, as documented by BleepingComputer’s coverage of FIN7 attacks. Recovery without paying is often impossible because attackers destroy decryption keys after payment failure.

🛡️ Mitigation

Defense measures include enforcing multi‑factor authentication on RDP, applying the principle of least privilege, and using Microsoft Defender for Endpoint with ASR rules to block LNK execution from untrusted sources. The MITRE ATT&CK technique T1486 (Data Encrypted for Impact) is directly relevant; organizations should maintain offline backups and monitor for abnormal scheduled task creation named “OneDriveUpdater”.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.