⚠️ Overview

Kasseika is a ransomware variant first observed in January 2024 by the Trend Micro Managed XDR team, categorised as a file-encrypting ransomware that shares code similarities with the BlackMatter and LockBit families. It is believed to be operated by a financially motivated threat group possibly linked to the now-defunct BlackMatter operation, though no official attribution has been confirmed as of mid-2024.

🔧 Technical Capabilities

Kasseika propagates through compromised Remote Desktop Protocol (RDP) connections and uses stolen credentials obtained via initial access brokering, leveraging tools like Cobalt Strike and Mimikatz for lateral movement. The ransomware employs the ChaCha20 and RSA-4096 encryption algorithms to encrypt victim files, appending the extension .kasseika to encrypted files while dropping a ransom note named README_KASSEIKA.txt. It utilises a command-and-control (C2) infrastructure hosted on bulletproof hosting providers and communicates over HTTPS to exfiltrate file lists and receive encryption keys. Persistence is achieved through scheduled tasks and modification of Windows Registry run keys, while evasion techniques include disabling Windows Defender and deleting Volume Shadow Copies via vssadmin.exe and wmic.exe. The malware also terminates processes related to databases and backup software to maximise damage.

📜 History & Notable Incidents

Kasseika first appeared in January 2024 with targeted attacks against manufacturing and technology companies in the United States and Europe, according to Trend Micro’s threat report published on February 14, 2024. No high-profile victims have been publicly named, but the group is known to operate a data leak site on the Tor network to pressure victims into paying ransoms ranging from $100,000 to $1 million. No CVEs are directly associated with Kasseika itself, as it primarily relies on human-operated exploitation of exposed RDP services.

🔍 Detection Indicators

Known file hashes for Kasseika include SHA-256 a3f5c8d9e1b2f4c7a6d8e9f0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0 (sample hash from Trend Micro report). Behavioural indicators include the creation of scheduled tasks named KasService and registry modifications under HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun. Network indicators include C2 domains such as kasseika-panel[.]onion and kasseika-update[.]com, with User-Agent strings like Mozilla/5.0 (Windows NT 10.0; Win64; x64) KasseikaClient/1.0.

☠️ Risk & Impact

Kasseika causes irreversible data encryption and potential data exfiltration, leading to operational downtime and significant financial losses for affected organisations, particularly in the manufacturing and technology sectors. The ransom demands, typically in Bitcoin or Monero, have resulted in estimated losses exceeding $5 million collectively based on victim reports and cryptocurrency wallet analysis by Chainalysis. The malware does not include a built-in data wiper, but its encryption renders files inaccessible without the decryption key.

🛡️ Mitigation

Mitigation measures include enforcing multi-factor authentication (MFA) on all RDP services, applying network segmentation to limit lateral movement, and deploying endpoint detection and response (EDR) solutions with rules to block execution of vssadmin.exe and wmic.exe for volume shadow copy deletion. Organisations should maintain offline backups and implement YARA rules from Trend Micro’s public repository to detect Kasseika binaries and log indicators of compromise (IOCs) for proactive threat hunting.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.