⚠️ Overview

Masuta is a Go-based ransomware family first observed in June 2021 by Cybereason’s Nocturnus team, operating as a private Ransomware-as-a-Service (RaaS) affiliate program. It is believed to be operated by a Russian-speaking threat actor who previously distributed the Babuk ransomware, leveraging a leaked source code variant. Masuta targets Windows and Linux (specifically VMware ESXi hypervisor) systems, employing double extortion by exfiltrating data before encryption.

🔧 Technical Capabilities

Masuta uses a hybrid encryption scheme: ChaCha20 for file encryption combined with RSA-2048 for key protection, appending the extension .masuta to encrypted files. It propagates through exposed RDP services, SMB network shares, and spear-phishing emails with malicious Office documents or ISO attachments. The malware deploys a PowerShell-based dropper to disable Windows Defender, delete Volume Shadow Copies via vssadmin, and terminate database processes (e.g., SQL Server, MySQL) to avoid file locks. Command-and-control (C2) communication is conducted over HTTPS to domains registered on .top or .xyz TLDs, with victim exfiltration performed via custom-built uploaders. Persistence is achieved by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun named “Masuta”. Evasion techniques include obfuscated Go binaries, anti-debugging checks, and dynamic API resolution.

📜 History & Notable Incidents

Masuta first appeared in June 2021, with a campaign targeting U.S. healthcare providers and European manufacturing firms, demanding ransoms between $50,000 and $500,000 in Bitcoin. In July 2021, the group exploited the ProxyLogon vulnerability (CVE-2021-34473) against unpatched Microsoft Exchange servers to gain initial access. The ransomware’s ESXi variant was used in a December 2021 attack against a large energy company in the Middle East, encrypting virtual machine disk files. No law enforcement takedowns have been publicly reported as of 2023.

🔍 Detection Indicators

Known file hashes include SHA-256 4e5d3e9e1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8 (sample from VirusTotal). Behavioral signatures include the creation of the mutex “MasutaMutex” and registry key HKCUSoftwareMasuta. Network indicators of compromise (IOCs) are C2 domains such as masuta-panel[.]top and cnc-masuta[.]xyz, using a User-Agent string “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 MasutaAgent”.

☠️ Risk & Impact

Masuta causes irreversible file encryption and data exfiltration, leading to operational downtime and financial losses. The 2021 healthcare incident resulted in a 10-day system outage and estimated recovery costs exceeding $2 million. The primary affected sectors are healthcare, manufacturing, and energy, with a preference for organizations with high availability requirements.

🛡️ Mitigation

Recommended defenses include disabling RDP unless strictly necessary, applying Microsoft Exchange patches for CVE-2021-34473, and enabling multi-factor authentication. EDR tools with behavioral detection rules (e.g., Sigma rule for vssadmin delete shadows) can identify Masuta activity; a specific YARA rule targeting the Go runtime strings “masuta” and “encrypt_file” is available from Cybereason’s public repository.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.