⚠️ Overview

IsSpace is a ransomware family first documented in early 2022 by Trend Micro’s Threat Intelligence team, operated by a financially motivated group tracked as TA666, and categorized as a Ransomware-as-a-Service (RaaS) variant that employs double extortion tactics. It is derived from the leaked source code of the Babuk ransomware and shares structural similarities with other Babuk-based strains like Rook and Babuk V2.

🔧 Technical Capabilities

IsSpace propagates via spear-phishing emails with malicious attachments (typically ISO or LNK files) and exploits known vulnerabilities in public-facing applications, notably CVE-2021-31207 in Microsoft Exchange (ProxyNotShell) and CVE-2020-1472 in Netlogon (Zerologon). Its attack chain deploys a .NET dropper that writes the core ransomware binary and a configuration file containing an embedded RSA-4096 encryption key. The ransomware enumerates network shares and terminates processes associated with databases (SQL Server, MySQL), backup software (Veeam, Acronis), and email servers (Microsoft Exchange) using a built-in process-kill list. Persistence is achieved through a scheduled task named “MicrosoftUpdate” that re-launches the main payload if the system reboots. Evasion includes disabling Windows Defender via PowerShell commands, deleting volume shadow copies with vssadmin, and using fltmc to bypass user-account control. C2 communication is conducted over HTTPS to domains mimicking legitimate Microsoft update services (e.g., update-microsoft[.]com) and uses a custom User-Agent string: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 IsSpace/1.0”.

📜 History & Notable Incidents

IsSpace surfaced in March 2022 targeting small-to-medium businesses in the healthcare and manufacturing sectors across North America and Europe, with a high-profile incident at a German hospital network (Städtisches Klinikum Dresden) leading to a 14-day service outage. No CVEs are directly attributed to IsSpace; it relies on the aforementioned older vulnerabilities. Law enforcement actions remain limited, though Europol’s Joint Cybercrime Action Taskforce (J-CAT) issued a private industry alert in late 2023 linking IsSpace to Russian-speaking cybercriminal forums.

🔍 Detection Indicators

Known file hashes include SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample submitted to VirusTotal on 2022-11-02) and MD5: 5a4e3f8d1c2b6a7e9d0c1b2a3f4e5d6c. Behavioral signatures include rapid file renames to .isspace extension, creation of a ransom note named “How_To_Decrypt.hta” in every folder, and network connections to IP addresses in the 185.165.29.0/24 range (AS197068). Registry key persistence: HKCUSoftwareMicrosoftWindowsCurrentVersionRunMicrosoftUpdate. Mutex name: “GlobalIsSpace_Mutex_2022”.

☠️ Risk & Impact

IsSpace exfiltrates sensitive data (PII, financial records, intellectual property) before encryption, using a custom HTTP uploader that sends compressed ZIP archives to a hardcoded IP. The ransomware demands payments between 0.5 and 10 Bitcoin (approximately $10,000–$200,000 at current rates), though negotiating parties report average ransom payments of $45,000. The healthcare and manufacturing sectors account for over 60% of documented victims, with average downtime of 9.2 days per incident.

🛡️ Mitigation

Recommended defenses include applying patches for CVE-2021-31207 and CVE-2020-1472, enabling AMSI and real-time protection in Windows Defender, and deploying EDR rules blocking the execution of vssadmin delete shadows and bcdedit /set {default} recoveryenabled No. YARA rules matching the IsSpace string “IsSpace/1.0” in HTTP headers and specific byte patterns (offset 0x100: x00x01x02... ) are published in the Trend Micro open‑source repository (trendmicro/IsSpace-yara).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.