A deep dive into Water Roc, one of the most relentless ransomware groups

### Overview Threat researchers from Trend Micro present an in-depth analysis of Water Roc, a relentless ransomware group associated with the Nephilim ransomware-as-a-service (RaaS) operation. The presentation traces the historical evolution of modern ransomware—from mass-mail campaigns (2012–2017) and worm-like outbreaks (WannaCry, NotPetya) to targeted attacks driven by underground supply chains comprising initial access brokers, botnets (e.g., Emotet, Trickbot, IcedID, Qakbot), and malware-as-a-service. Water Roc emerged in 2020 as a sophisticated RaaS actor targeting large enterprises, exhibiting distinct lineage to the earlier Nemty operation and employing double extortion tactics.

### Key Topics - **Evolution to Targeted Ransomware:** The transition toward exploiting internet-exposed services, RDP vulnerabilities, credential weaknesses, and underground affiliate-based monetization. - **Water Roc and Nephilim Origins:** First spotted in 2020 targeting organizations with over $1 billion in revenue, Nephilim shares significant code similarities and recruitment overlaps (such as aliases 'js forum' and 'jingo') with Nemty, offering affiliate revenue splits ranging from 70/30 to 90/10. - **Initial Access and Lateral Movement:** Exploitation of external-facing vulnerabilities, notably a critical Citrix flaw disclosed in December 2019, alongside older vulnerabilities such as EternalBlue, SMBGhost, and a 2017 privilege escalation proof-of-concept by Google researchers. - **Relentless Leaking Behavior and Victimology:** Unlike competitors that publish hundreds of victims indiscriminately, Water Roc targets high-revenue organizations (median revenue of around $900 million) primarily in the US and Australia. They host stolen content on Tor hidden services and publish leaks over prolonged durations—up to 4 to 13 months for a quarter of victims.

### Technical Details - **Attack Lifecycle & Tooling:** Post-exploitation heavily incorporates Cobalt Strike. In one tracked incident, Water Roc persisted after multiple anti-malware detections over 17 days before deploying signed beacons, followed by another week before deploying ransomware. The group relies on Process Hacker to terminate security and monitoring tools, Mimikatz for credential dumping, NLBrute for RDP brute-forcing, BloodHound/Sharphound and ADFind for Active Directory discovery, and SMB tools leveraging NTLM hashes. Exfiltration relies on 7-Zip archiving paired with FTP scripts or MegaSync. - **Cryptographic Inner Workings:** Reverse engineering of the Go-based Nephilim binary reveals an embedded AES-CTR encrypted JSON configuration containing a Base64-encoded ransom note and an embedded RSA public key. During execution, it generates two sequences of pseudo-random bytes: an AES key and an AES initialization vector/nonce (AES-CTR mode). File contents are encrypted and appended with the RSA-encrypted AES key and nonce, terminating with a 512-byte footer and a `.kayano` marker/extension.

### Takeaways Defenders and researchers have multiple strategic interception windows to counter Water Roc: 1. **Reconnaissance & Exploitation:** Deploying Intrusion Prevention Systems (IPS) for virtual patching against external exploits before official fixes can be staged. 2. **Lateral Movement Detection:** Monitoring for Cobalt Strike beacons, unevaded network indicators, and command-and-control blocklists. 3. **Exfiltration & OPSEC Exploitation:** Detecting bulk file archiving and anomalous uploads (FTP/MegaSync). Furthermore, threat actors frequently commit operational security errors when hosting data or configuring Tor hidden servers, exposing backend IPs that allow researchers and law enforcement to map infrastructure and target money laundering flows.