Ransomware

KageNoHitobito Ransomware

Cybersec Sentinel

May 1, 2024 • 1 min read

Overview

KageNoHitobito is a ransomware that has been actively targeting Windows users globally. It encrypts files on local drives, appending a ".hitobito" extension, and demands a ransom through a ransom note displayed on the victim’s desktop. Victims are directed to contact the attackers via a Tor site using the AbleOnion chat platform.

Infection Vector

The ransomware spreads primarily through deceptive tactics, where it masquerades as legitimate software or game cheats downloaded from file-sharing services. This method suggests the attackers are exploiting user trust and behavior to initiate the malware infection (BugsFighter).

Attack Details

Once executed, KageNoHitobito avoids encrypting critical system files to keep the system operational, likely to ensure communication for ransom negotiations remains possible. The ransomware utilizes sophisticated techniques to evade detection and leverage the compromised systems for financial extortion (BugsFighter).

Ransom Note Instructions

Victims find instructions within a text file named "KageNoHitobito_ReadMe.txt", guiding them to use Tor to contact the attackers and negotiate the ransom. There is no guarantee that payment will lead to data recovery, making prevention and timely response crucial (BugsFighter).

Prevention and Mitigation

User Awareness: Users should be cautious of unknown downloads and avoid using cracked software. Awareness of phishing tactics and maintaining software updates are essential preventative measures.
Data Backups: Regular backups of critical data to separate devices or cloud storage can help restore data without succumbing to ransom demands.
Security Solutions: Employing reputable anti-malware and anti-ransomware solutions can help detect and quarantine malicious activities before they manifest into full-blown infections.

Indicators of Compromise (IoCs)

SHA256 Hashes:

8939bfe20bc6476806d22c8edfcaba5c36f936b893b3de1c847558502654c82f

1940fcdb2561c2f7b82f6c44d22a9906e5ffec2438d5dadfe88d1608f5f03c33

506e8753dd5ca1c8387be32f26367e26f242b7c65e61203f7f926506c04163aa

8a10e0dc4994268ea33baecd5e89d1e2ddabef30afa09961257a4329669e857a

bec9d2dcd9565bb245f5c8beca4db627390bcb4699dd5da192cc8aba895e0e6a

0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca

6d6134adfdf16c8ed9513aba40845b15bd314e085ef1d6bd20040afd42e36e40

b32ae94b32bcc5724d706421f915b7f7730c4fb20b04f5ab0ca830dc88dcce4e

74b5e2d90daaf96657e4d3d800bb20bf189bb2cf487479ea0facaf6182e0d1d3

0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4

These IoCs should be used to aid in the detection and mitigation of KageNoHitobito ransomware attacks.

Sources

Ransomware Roundup - KageNoHitobito and DoNex (Fortinet)

KageNoHitobito and DoNex Ransomware Plaguing Global Entities (Hive Pro)

Conclusion

KageNoHitobito ransomware exemplifies the persistent threat posed by ransomware attacks globally. The targeting strategy, leveraging user behavior and system vulnerabilities, underlines the importance of comprehensive cybersecurity measures at both individual and organizational levels. Organizations are encouraged to enhance their defensive strategies and educate their users to mitigate the risk posed by such ransomware campaigns.