The Rise of FusionCore An Emerging Cybercrime Group from Europe

EXECUTIVE SUMMARY

The CYFIRMA research team has identified a new up-and-coming European threat actor group known as FusionCore. Running Malware-as-a-service, along with the hacker-for- hire operation, they have a wide variety of tools and services that are being offered on their website, making it a one-stop-shop for threat actors looking to purchase cost- effective yet customizable malware. The operators have started a ransomware affiliate program that equips the attackers with the ransomware and affiliate software to manage victims. FusionCore typically provides sellers with a detailed set of instructions for any service or product being sold, enabling individuals with minimal experience to carry out complex attacks.

INTRODUCTION

In this research report, we will discuss previously undiscovered malware being sold by FusionCore, its respective capabilities and the level of sophistication of the threat actors. FusionCore was founded in 2022 by user “Hydra”, the co-developer of the Typhon Reborn stealer. This malware developer has been in the stealer development and logs-selling business for a few years now, initially, being involved with the NoMercy infostealer, along with another associate that goes by the alias; “NecroSys”.

Researchers found the NoMercy stealer to be very crude and basic, and observations indicate that it was at the initial stages of development in early 2022. Based on the feedback from the threat actors, who were using the NoMercy infostealer, Hydra quickly realized that there is a high demand for all kinds of malware, not just infostealers. He decided to build a team that develops custom malware – and named the team FusionCore. Their malware catalogue includes, Typhon-R Stealer, RootFinder Stealer, RootFinder RAT, Cryptonic Crypter, RootFinder Ransomware, RootFinder Miner, Golden Mine, ApolloRAT, SarinLocker and KratoS dropper; with many new malwares already in the pipeline.

The other primary associates of FusionCore include, “NecroSys” (developer of SarinLocker, Typhon Stealer, Kratos Dropper, Ambien RAT), “DanielNusradin” (developer of RootFinder RAT, RootFinder Miner, RootFinder Stealer and RootFinder Ransomware), “InsaniumDev” (the developer of Golden Mine) and “SysKey” (group administrator, malware developer). Given the breadth of the threat actor group’s capabilities, translating into a range of lateral movements, a successful attack could result in significant financial and operational damage, as well as damage to the organization’s reputation among customers, investors, and partners. The CYFIRMA research team was able to obtain a few of the previously undiscovered malware samples being used by FusionCore operators. We will analyze them and share our findings with the community in our upcoming research reports.

FUSIONCORE GROUP PROFILE

FusionCore aliases are highly influenced by Greek and Roman mythology. Hydra named himself after a serpentine water monster Lernaean Hydra (the many-headed serpent who, when one of its heads was cut off, grew two more) in Greek Mythology. The Typhon stealer’s name is based on a monstrous serpentine giant, Typhon in Greek mythology. We have observed a trend within FusionCore’s primary operators to name their flagship malware after Greek mythological creatures. Most of the malware programs developed by FusionCore are written in C++, C# and Go. The operators are using open-source .NET obfuscators such as Obfuscar, NETShield and ConfuserEx to increase the evasiveness of their crypter stub (software that can encrypt, obfuscate, and manipulate malware). The group highly relies on open-source software, with NBMiner and xmrig as part of their tool arsenal to enable cryptocurrency mining.

TIMELINE OF FUSIONCORE EVOLUTION

June 2022
After working on new features and evasion capabilities, Hydra started selling the Typhon-stealer, released on their new telegram channel.

July 2022
Typhon stealer was being updated frequently, based on user feedback.

July 2022
The MaaS operators were found to provide malware-spreading services across the globe, indicating that they likely have access to a private botnet, spanned across multiple geographies. The operators were found to charge a higher price, to spread malware within Europe, than any other continent.

September 2022
FusionCore’s telegram channel was created for streamlining MaaS operations:

Due to a lack of buyers, Hydra was willing to recruit a Russian-speaking advertiser, who would advertise the products on underground forums, channels, etc. with a 25% commission for the marketer on the revenue.

October 2022
Another malware developer in FusionCore that goes by the alias NecroSys came in advertising a soon-to-be-released ransomware written in C#, called SarinLocker.

November 2022
The group admin, SysKey announced the official launch of the webshop for FusionCore.

November 2022
The operators released an announcement, regarding the upcoming tools and related features:

January 2023
The MaaS operators were looking to expand their team with the addition of an experienced malware developer.

Needless to say, the post gained traction from the malware developers’ community.

February 2023
Leveraging the poor Operations Security (OpSec) from the MaaS operators, the CYFIRMA research team has obtained the C2 panel snippet, shared by the attacker on 25th February 2023 on their telegram channel (now deleted). The snippet reveals public IPs that are being used by the FusionCore for testing grounds for the malware:

The CYFIRMA research team will continue to monitor the infrastructure, as these are likely part of the botnet that the MaaS operators are using to provide malware- spreading services. The RootFinder telegram channel was deleted shortly, after the threat actors realized the operational error.

March 2023
Hydra shared a screenshot of the Typhon Reborn stealer dashboard (under development). Please take note that the dashboard is set to display Sweden time by default.

On 26th March 2023, NecroSys made an announcement on the Typhon stealer telegram channel about an upcoming, fully native, and fully undetectable ransomware, named “VIPERA Ransomware”, that is designed to encrypt victim files in microseconds.

Based on the available information and discussions, it can be ascertained with medium confidence that the operators of FusionCore are operating from Europe. The group acts as both malware developers and threat actors, providing malware subscriptions as well as hacker-for-hire services. Using phishing as their primary attack vector for initial access, FusionCore specializes in a wide range of malware, which makes them capable of carrying out stealthy and persistent attacks.

MALWARE OFFERED BY FUSIONCORE

SARINLOCKER

On 15th November 2022, NecroSys officially announced the release of SarinLocker v1.0, a ransomware which would use telegram for sending decryption keys and client information. It appends an extension SARIN.LOCKED on the encrypted files. The prices were really competitive, compared to other ransomware, as they were charging 20$ for a month, and 100$ for lifetime access.

Please take note that the ransomware has the ability to wipe the decryption key from the infected device’s memory – making it tougher to extract the key, during memory forensics.

The CYFIRMA research team was able to obtain a few of the malware samples, being used by FusionCore operators. We will analyze the obtained FusionCore samples and share our findings with the community in our upcoming research reports. Till then, security teams can find the IOC(s) at the end of this report to block as required.

Admin Panel

In November 2022, a poll was posted on the Typhon stealer telegram channel, regarding the development of SarinLocker v2.0

Please take note that the malware developer states that there will be 2 precompiled payloads for x64 and x86 systems.

On 22nd December 2022, NecroSys announced the release of SarinLocker v2.0, which was written in C++. Amongst other changes, the new version would have a longer decryption key for victims, as the decryption key in SarinLocker v1.0 was short and could be brute-forced.

ROOTFINDER STEALER

On 14th February 2023, Hydra started advertising a new information stealer, called the RootFinder Stealer on the Typhon Stealer telegram channel.

The developer of RootFinder range of malwares (Stealer, RAT, Ransomware, Miner) is using the alias, Daniel Nusradin. We believe that the developer of RootFinder is a novice at this stage and is taking guidance from the more seasoned members of FusionCore on how to develop malware.

It is a variant based on the Redline and Typhon Stealer. The infostealer uses a telegram bot for receiving data from the infected device.

Features:

• Grabs the victims’ details (Date & Time, Computer User, Operating System, Operating System Version, DNS hostname, Installed Anti-Virus, And the Computer language)
• Harvests hardware information (HWID, RAM Sizə (in Megabytes), Memory Devices, BIOS Caption, BIOS Manufacturer, Graphics Card, CD-Rom path)
• Collects Network Information (Private IP address, External IP address, Subnet Scan, Mac Address)
• Data recovery (Passwords, Cookies, Autofills, Credit Cards, Search History)

ROOTFINDER RANSOMWARE

There’s very limited information about the RootFinder ransomware. The ransomware’s author seems inexperienced, with poor OpSec, so it’s unlikely that the malware will become more sophisticated and widespread anytime soon.

Features:

• The Ransomware employs an encryption process that is completely undetectable and can encrypt files more quickly. The encryption method used is AES Encryption.
• The Ransomware is designed to be lightweight, with a size of only 26 KB.
• Upon installation, the malware connects to an HTTP Panel and transmits the personal installation key to the attacker.
• The Ransomware can generate unique decryption keys for each victim.
• Additionally, there is a separate application for affiliates that requests the Personal Installation Key. The attacker must provide the victim’s Installation Key in the application to obtain the decryption key.
• Buyers(attackers) are registered to a web panel, enabling them to log in and access the ransomware admin panel.

CRYPTONIC

Cryptonic is a .NET crypter that’s compatible with both .NET and Native Payloads. A crypter is a type of software that can encrypt, obfuscate, and manipulate malware, making it harder to detect by security programs. Cryptonic comes with an easy-to-use builder and each stub is unique. It is not for sale yet as the threat actors have not finished the development. However, anyone who is interested can purchase test crypts, that are being sold for $5 equivalent in XMR or ETH.

Threat actors can use Cryptonic to make known malware undetectable by Antivirus engines. FusionCore demonstrated this by using Cryptonic on a previously known LockBit 3.0 sample:

GOLDENMINE

GoldenMine is a cryptocurrency miner written in .NET. The miner is based on open- source tools, named NBMiner and XMRig. It can mine a wide variety of coins such as XMR, ETH, RVN, BEAM, and more, supporting both CPU & GPU mining.

Features:

• The miner’s custom arguments are modified dynamically at the beginning of the process.
• The client allows for restarts, while miners are currently running.
• The client has the capability to detect if miners are being terminated or not.
• The client provides protection for miners(anti-analysis).

STRONTIUM STEALER

This infostealer is a relatively new addition to FusionCore’s malware arsenal.

Features:

• The server and client components of the malware are lightweight. The client component is only 83KB in size.
• The malware can gather basic system information from the victim’s computer.
• It is capable of stealing passwords, cookies, autofill data, and credit card information.
• The malware also includes spying functions such as activating a keylogger and taking screenshots of the victim’s desktop.
• The client component has an AntiAnalysis module to prevent security researchers from analyzing the malware.
• The connection between the malware and the C2 server is encrypted.
• The server component can generate an obfuscated client to evade detection by anti-virus software.
• The malware is designed to bypass majority of anti-virus programs.

EXTERNAL THREAT LANDSCAPE MANAGEMENT (ETLM) INSIGHTS

Threat Actor Profile: The members of FusionCore are young (possibly in their late teens), yet ambitious malware developers who have a wide variety of skills, depending on the type of malware that needs to be built. FusionCore is running a Malware-as-a-service model (MaaS), along with hacker-for-hire services, relying largely upon open-source tools, such as Obfuscar, NETShield, ConfuserEX, for increasing evasiveness in their malware toolkit.

Threat Landscape: FusionCore operators have started an affiliate program, named AnthraXXXLocker, and more affiliates are likely to join the group in the upcoming months. Furthermore, with the addition of new developers, FusionCore is set to enhance its malware arsenal in the coming future, adding to the already booming infostealer business, as well as dipping their toes into the extortion business.

Victimology: The targets of FusionCore would predominantly depend on the buyers and affiliates. Given they are a young up-and-coming group, they are willing to work with anyone, from anywhere. However, so far, the known targets of FusionCore include, Lindesberg Municipality in Sweden, and the Typhon Stealer was observed in a phishing attempt, against an infosec company in Asia Pacific.

Impact Assessment: The threat actor group’s diverse catalogue of malware presents a multifaceted risk to an organization, with the potential for financial losses due to data theft, operational disruptions caused by ransomware attacks, and reputational damage resulting from breaches of sensitive data.

The group’s hacker-for-hire services and stealer capabilities offer a significant threat to the organization’s digital assets, potentially leading to financial losses, due to stolen intellectual property or compromised customer data.

The use of crypters in FusionCore’s malware suggests a sophisticated approach, increasing the potential impact of their attacks and the difficulty of detecting and mitigating them.

CONCLUSION

The members of the new FusionCore group are coming up with their own set of malwares, with the help of more seasoned malware developers present in the group. Their developing catalogue of tools suggests they have the ambition to create a suite, covering most, if not all of kill-chain, creating a one-stop shop for threat actors.

Due to the emergence of Malware-as-a-Service (MaaS), cyber-attacks have become more sophisticated than before. With the potential of a single data breach bringing down an entire system, attackers currently have a significant advantage. It is also imperative to have complete visibility onto the attack surface, as security teams cannot protect against what they cannot see.

MITIGATION STRATEGIES / RECOMMENDATIONS

Strategic Recommendations

• Conduct regular vulnerability assessments and penetration testing to identify and remediate vulnerabilities.
• Develop and implement an incident response plan, that includes clear procedures for containment, investigation, and recovery from security incidents.
• Review and update security policies and procedures to ensure they align with best practices and regulatory requirements.
• Foster a security-first culture, by promoting security awareness and accountability at all levels of the organization.

Management Recommendations

• Invest in ongoing security training and development for IT staff, to ensure they have the skills and knowledge necessary to protect the organization’s assets.
• Establish a security governance framework that includes clear roles and responsibilities for managing security risks.
• Engage with industry peers and partners to share threat intelligence and best practices for mitigating cybersecurity risks.
• Regularly review and update the organization’s risk management strategy to ensure it reflects the evolving threat landscape and business priorities.

Tactical Recommendations

• Implement network segmentation to limit the impact of successful attacks on critical systems.
• Deploy endpoint protection solutions to detect and prevent malware infections.
• Train employees on security awareness best practices to reduce the risk of successful phishing attacks.
• Monitor network traffic and user activity to detect and respond to suspicious behavior.

APPENDIX I

Indicators Of Compromise (IOCs)

APPENDIX II

MITRE Mapping

Sigma Rule(s)

RootFinder Stealer
title: Suspicious Network Command
description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
tags:
  – attack.discovery
  – attack.t1016
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      – ‘ipconfig /all’
      – ‘netsh interface show interface’ – ‘arp -a’
      – ‘nbtstat -n’
      – ‘net config’
      – ‘route print’
  condition: selection
level: low