Today, you likely often authenticate or pay for things with a tap, either using a chip in your card, or with your phone, or maybe even with your watch or a Yubikey. Now, imagine doing all these things way back in 1998 with a single wearable device that you could shower or swim with. Sound crazy?

These types of transactions and authentications were more than possible then. In fact, the Java ring and its iButton brethren were poised to take over all kinds of informational handshakes, from unlocking doors and computers to paying for things, sharing medical records, making coffee according to preference, and much more. So, what happened?

Just Press the Blue Dot

Perhaps the most late-nineties piece of tech jewelry ever produced, the Java Ring is a wearable computer. It contains a tiny microprocessor with a million transistors that has a built-in Java Virtual Machine (JVM), non-volatile storage, and an serial interface for data transfer.

A family of Java iButton devices and smart cards, including the Java Ring, a Java dog tag, and two Blue Dot readers. Image by [youbitbrain] via redditTechnically speaking, this thing has 6 Kb of NVRAM expandable to 128 Kb, and up to 64 Kb of ROM (PDF). It runs the Java Card 2.0 standard, which is discussed in the article linked above.

While it might be the coolest piece in the catalog, the Java ring was just one of many ways to get your iButton. But wait, what is this iButton I keep talking about?

In 1989, Dallas Semiconductor created a storage device that resembles a coin cell battery and uses the 1-Wire communication protocol. The top of the iButton is the positive contact, and the casing acts as ground. These things are still around, and have many applications from holding bus fare in Istanbul to the immunization records of Canadian cows.

For $15 in 1998 money, you could get a Blue Dot receptor to go with it for sexy hardware two-factor authentication into your computer via serial or parallel port. Using an iButton was as easy as pressing the ring (or what have you) up against the Blue Dot.

Indestructible Inside and Out, Except for When You Need It

It’s a hefty secret decoder ring, that’s for sure.
Made of of stainless steel and waterproof grommets, this thing is built to be indestructible. The batteries were rated for a ten-year life, and the ring itself for one million hot contacts with Blue Dot receptors.

This thing has several types of encryption going for it, including 1024-bit RSA public-key encryption, which acts like a PGP key. There’s a random number generator and a real-time clock to disallow backdating transactions. And the processor is driven by an unstabilized ring oscillator, so it constantly varies its clock speed between 10 and 20 MHz. This way, the speed can’t be detected externally.

But probably the coolest part is that the embedded RAM is tamper-proof. If tampered with, the RAM undergoes a process called rapid zeroization that erases everything. Of course, while Java Rings and other iButton devices maybe be internally and externally tamper-proof, they can be lost or stolen quite easily. This is part of why the iButton came in many form factors, from key chains and necklaces to rings and watch add-ons. You can see some in the brochure below that came with the ring:

The Part You’ve Been Waiting For

I seriously doubt I can get into this thing without totally destroying it, so these exploded views will have to do. Note the ESD suppressor.

So, What Happened?

I surmise that the demise of the Java Ring and other iButton devices has to do with barriers to entry for businesses — even though receptors may have been $15 each, it simply cost too much to adopt the technology. And although it was stylish to Java all the things at the time, well, you can see how that turned out.

If you want a Java Ring, they’re on ebay. If you want a modern version of the Java Ring, just dissolve a credit card and put the goodies in resin.

The Netherlands' government and opposition are both against the latest version of the controversial EU regulation aimed at detecting online child sexual abuse material (CSAM), according to an official position and an open letter published on Tuesday (1 October).

euractiv.com/section/law-enfor…

Drones that charge right on the power lines they inspect is a promising concept, but comes with plenty of challenges. The Drone Infrastructure Inspection and Interaction (Diii) Group of the University of South Denmark is tackling these challenges head-on.

The gripper for these drones may seem fairly straightforward, but it needs to inductively charge, grip, and detach reliably while remaining simple and lightweight. To attach to a power line, the drone pushes against it, triggering a cord to pull the gripper closed. This gripper is held closed electromagnetically using energy harvested from the power line or the drone’s battery if the line is off. Ingeniously, this means that if there’s an electronics failure, the gripper will automatically release, avoiding situations where linemen would need to rescue a stuck drone.Accurately mapping power lines in 3D space for autonomous operation presents another hurdle. The team successfully tested mmWave radar for this purpose, which proves to be a lightweight and cost-efficient alternative to solutions like LiDAR.

We briefly covered this project earlier this year when details were limited. Energy harvesting from power lines isn’t new; we’ve seen similar concepts applied in government-sanctioned spy cameras and border patrol drones. Drones are not only used for inspecting power lines but also for more adventurous tasks like clearing debris off them with fire.

youtube.com/embed/zDUGltWmXOU?…

youtube.com/embed/MORFX3CFygk?…

hackaday.com/2024/10/01/the-ch…

La scorsa settimana, Microsoft ha rilasciato un aggiornamento in anteprima KB5043145 per Windows 11 23H2 e 24H2, che non è correlato alla sicurezza. Gli utenti hanno segnalato che l’installazione di questo aggiornamento potrebbe causare riavvii infiniti, schermata blu o verde della morte (BSOD, GSOD) e avvio in modalità di ripristino BitLocker.

Inizialmente si prevedeva che KB5043145 apportasse una serie di nuove funzionalità, ma ciò non è avvenuto e l’aggiornamento ha risolto solo alcuni problemi, incluso il blocco di Edge e Task Manager.

Un giorno dopo il rilascio dell’aggiornamento, gli sviluppatori Microsoft hanno segnalato problemi e aggiunto informazioni alla documentazione KB5043145 secondo cui gli utenti di Windows 11 22H2 e 23H2 potrebbero riscontrare riavvii infiniti e in alcuni casi il computer potrebbe smettere di rispondere completamente.

“Alcuni utenti hanno segnalato che dopo aver installato questo aggiornamento, i loro dispositivi si riavviano più volte o non rispondono con una schermata blu o verde”, ha scritto Microsoft. – Secondo questi rapporti, alcuni dispositivi eseguono automaticamente lo strumento di riparazione automatica dopo ripetuti tentativi di riavvio. In alcuni casi, potrebbe essere avviata anche la modalità di ripristino BitLocker.”

Microsoft afferma che sta già indagando sul problema e sta lavorando per risolverlo. La società promette di fornire informazioni aggiornate non appena saranno disponibili.

In un post separato, gli sviluppatori Microsoft esortano tutti gli utenti che riscontrano problemi dopo l’installazione di KB5043145 a inviare un rapporto a Feedback Hub e fornire informazioni dettagliate su quanto accaduto.

L'articolo KB5043145: L’Aggiornamento Windows 11 Sta Causando Riavvi infiniti proviene da il blog della sicurezza informatica.

Key Group, or keygroup777, is a financially motivated ransomware group primarily targeting Russian users. The group is known for negotiating with victims on Telegram and using the Chaos ransomware builder.

The first public report on Key Group’s activity was released in 2023 by BI.ZONE, a cybersecurity solutions vendor: the attackers drew attention when they left an ideological note during an attack on a Russian user, in which they did not demand money. However, according to our telemetry, the group was also active in 2022. Both before and after the attack covered in the BI.ZONE report, the attackers demanded that money be transferred to a Bitcoin wallet.

We tracked Key Group’s activity from the start of their attacks and found that the group used not only Chaos but also other leaked ransomware builders. By analyzing the samples created with their help, we were able to find loaders and malicious URLs on GitHub that showed a connection between the group and previously unknown attackers.

Timeline of Key Group’s activity

The first variants of ransomware from Key Group’s arsenal were discovered in April 2022. At that time, the group was using the source code of Xorist.

In August 2022, Key Group added the Chaos builder to its toolkit. Notably, on June 30, 2022, the creator of Chaos announced the launch of a RaaS (Ransomware-as-a-Service) partnership program.

In the Chaos variant, a new extension
.huis_bn was added to encrypted files, and in the ransom note, the attackers requested that victims send a message on Telegram. This note contained information in both Russian and English and went under the title “HOW TO DECRYPT FILES”:Attention! All your files are encrypted!
To restore your files and access them,
send an SMS with the text C32d4 to the User Telegram @

[redacted]You have 1 attempts to enter the code. If this
amount is exceeded, all data will irreversibly deteriorate. Be
careful when entering the code!

Glory @huis_bn
Ваши файлы зашифрованы!
Чтобы восстановить свои файлы и получить к ним доступ,
отправьте смс с текстом C32d4 Юзеру Телеграм @
[redacted]The next Key Group samples based on Chaos were discovered in January 2023. Throughout the year, the group used this ransomware, primarily changing only the content of the ransom note.

Starting in April 2023, the attackers were active on the DarkStore forum in the dark web. They targeted Telegram channels with spam raids and tested the publicly available remote access Trojan NjRat, which has keylogging, stealing, reverse shell, and USB propagation capabilities.

In the summer of 2023, a new sample of Chaos from Key Group was discovered, named
warnep.exe (MD5: C2E1048E1E5130E36AF297C73A83AFF6).
The content of the note was significantly different from previous ones and was of an ideological nature. Key Group no longer provided contact information but declared its motives.

Note from Key Group

In August 2023, we discovered the group using the Annabelle ransomware (MD5: 05FD0124C42461EF553B4B17D18142F9).

This ransomware is named after the American horror film “Annabelle”. The sample observed in Key Group’s attacks encrypts files and includes an MBR locker (MD5: D06B72CEB10DFED5ECC736C85837F08E), as well as the following built-in evasion techniques.

1. Disabling Windows Firewall:
   NetSh Advfirewall set allprofiles state off
2. Disabling Windows Defender:
   HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\
   "DisableAntiSpyware" = 1
   "DisableRealtimeMonitoring" = 1
3. Disabling UAC:
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
   "EnableLUA" = 0
4. Disabling the Registry Editor:
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
   "DisableRegistryTools" = 0
5. Disabling the Run command from the Windows Start menu:
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
   "NoRun" = 1
6. Modifying Image File Execution Options by setting the RIP value instead of the debugger path for some processes, preventing them from launching correctly:
   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
   [process] "Debugger" = "RIP"
7. Deleting shadow copies:
   "vssadmin delete shadows /all /quiet"

The ransomware adds the
.Keygroup777tg.EXE extension to the encrypted files. After encryption, it restarts the computer and displays the following screens:

Screen from Annabelle (displayed immediately after encrypting files)

Screen from the MBR locker included in the Annabelle ransomware (displayed after reboot)

Around the same time, a sample of the Slam ransomware (MD5: 09CE91B4F137A4CBC1496D3791C6E75B) was detected in Key Group attacks. The Slam builder was also made publicly available back in 2021.

The Slam ransomware uses the AES-CBC encryption algorithm. It also utilizes the IP Logger service to track infected victims.

Upon execution, the ransomware encoded file names using Base64 and added the
.keygroup777tg extension.
In September 2023, a wiper based on the RuRansom builder (MD5: 1FED852D312031974BF5EB988904F64E) was found.

RuRansom is a wiper that emerged in 2022 and targets Russia. The malware is written in .NET and uses the AES-CBC encryption algorithm to encrypt files. The Key Group variant is distributed under the name “Россия-обновление.docs.exe” (Russia-update) with a note modified for the group’s objectives:

Note from Key Group (RuRansom sample)

Around the same time as the Key Group-branded RuRansom instances, a sample of another ransomware, UX-Cryptor, was observed in the attackers’ activities. It is also written in .NET (MD5: 6780495DAD7EB372F1A660811F4894A6).

Instead of encrypting files, this sample terminates the
explorer.exe process.taskkill.exe /im Explorer.exe /f
It sets the following text on the current screen using the .NET method
System.Windows.Forms.Label.set_Text:

Message from UX-Cryptor

After that, UX-Cryptor additionally saves the ransom note in a file named
info-0v92.txt, using output redirection of the echo command:cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%]
Ooops! Your files are encrypted by the keygroup777tg hacker group! Telegram for contact:
@[redacted] 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
UX-Cryptor includes several methods for persistence and detection evasion. For example, it overwrites the registry key
Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU:"Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\MRUList" = "abc"
The
RunMRU key is used by incident response specialists to examine commands executed through the Run utility.
In February 2024, Key Group switched from Chaos to the Hakuna Matata ransomware (MD5: DA09FCF140D3AAD0390FB7FAF7260EB5). The Hakuna Matata builder was published on the dark web in July 2023.

The Hakuna Matata variant encrypts files using AES-CBC and adds an extension of five random characters. Below is a snippet of Hakuna Matata running in our sandbox.

Snippet of the Hakuna Matata execution process

After encryption, the sample saves a file named
keygroup777.txt in the system and refers to it in a message set as the desktop wallpaper:

Hakuna Matata message on the desktop

Contents of the note:
Your Files Have Been Locked With keygroup777 Ransomware
you have to pay Bitcoin for Unlock Process
you can send a little file (less than 1 or 2 mb) for Decryption test (if we assume file is important we may ask you to Send another one)
Contact Us and Pay and get Decryption
Contact Our Email:******@yandex.ru
in Case of no reply from Email send message to my telegram id below
Telegram ID:@
[redacted]Your ID:4062********
In early March 2024, we discovered a Key Group sample based on the Judge/NoCry ransomware (MD5: 56F5A95FFA6F89C24E0880C519A2AA50).

The NoCry variant encrypts files using AES-256-CBC and adds the
.Keygroup777tg extension. The key used for encryption is generated based on the victim’s system data and sent to a C2 server in plain text, allowing the files to be decrypted without the attackers’ involvement.
It’s worth noting that instead of the C2 server address, Key Group provided a link to the Telegram channel
hxxps://t[.]me/s/SBUkr, to which the victim’s data and the encryption key were added in the following format:hxxps://t[.]me/s/SBUkr?[username]_[generated_id]=
[generated_key]The channel’s theme is not related to ransomware and consists of political news. This scheme does not involve the attackers obtaining the data.

Indicating the C2 server in code

Function for sending requests to C2 server

Detonation of Judge/NoCry

A complete timeline of Key Group’s use of various ransomware families is presented below.

Use of leaked Key Group builders

Delivery and infection

To deliver the Chaos and Xorist ransomware to the victim’s computer, Key Group used multi-stage loaders.

We discovered an LNK file that was likely distributed via phishing emails. The LNK file contained an obfuscated PowerShell command that downloaded an SFX archive (self-extracting archive) from a remote resource:

Deobfuscated command:

Upon extraction, the SFX archive saved another loader to the system. It downloaded another SFX archive containing a sample of the Chaos ransomware (MD5: C910DA0BAA2E08CEFCE079D1F7CB3469), as well as a separate loader that downloaded a sample of the Xorist ransomware (MD5: E0C744162654352F5E048B7339920A76).

The contents of the notes from the two ransomware variants were identical.

In October 2022, we discovered another loader that delivered a variant of Chaos (MD5: F93695564B97F03CC95CA242EDCFB5F8). The loader uses the .NET method
WebClient.DownloadData to download the ransomware (MD5: D655E77841CF6DB3008DCD60C9C5EB18) from a GitHub repository:hxxps://raw.githubusercontent[.]com/max444432/RMS2/main/dfff.exe
While studying this repository, we found the already familiar RuRansom wiper, the Hakuna Matata ransomware, as well as a sample of J-Ransomware/LoveYou and the NjRat remote access Trojan.

Persistence methods

Xorist

The first discovered sample of Key Group, the Xorist ransomware, established persistence in the system by changing file extension associations. When a file with the
.huis_bn extension, which was added to encrypted files, was opened, the ransomware would launch:HKLM\SOFTWARE\Classes\.huis_bn = "LGDAGXRNCRZHPLD"

HKLM\SOFTWARE\Classes\LGDAGXRNCRZHPLD\shell\open\command =
"C:\Users\[redacted]\AppData\Local\Temp\fj6qD14qWC1unS2.exe"
The ransomware also added itself to startup:
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
"Alcmeter" = "C:\Users\[redacted]\AppData\Local\Temp\fj6qD14qWC1unS2.exe"
Chaos

The Chaos ransomware (MD5: C910DA0BAA2E08CEFCE079D1F7CB3469) copied itself to
$user\$appdata\cmd.exe and executed this file as a new process. The new process, in turn, created a new file in the startup folder: $user\$appdata\Microsoft\Windows\Start Menu\Programs\Startup\cmd.url, containing the following:URL=file:///$user\$appdata\cmd.exe
Annabelle

The Annabelle ransomware added itself to the
Run and Winlogon registry keys.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"UpdateBackup" = "$selfpath"

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
"UpdateBackup" = "$selfpath"

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Shell" = "$selfpath"
UX-Cryptor

UX-Cryptor added itself to the following registry keys to maintain persistence in the system:
HKU\$usersid\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
"Shell" = "$selfpath"

HKU\$usersid\Software\Microsoft\Windows\CurrentVersion\Run
"WindowsInstaller" = "$selfpath -startup"
"MSEdgeUpdateX" = "$selfpath"

HKU\$usersid\Software\Microsoft\Windows\CurrentVersion\RunOnce
"System3264Wow" = "$selfpath --init"
"OneDrive10293" = "$selfpath /setup"
"WINDOWS" = "$selfpath --wininit"
Additionally, it added the following executable file names to startup:
HKU\$usersid\Software\Microsoft\Windows\CurrentVersion\Run
"WIN32_1" ="AWindowsService.exe"
"WIN32_2" = "taskhost.exe"
"WIN32_3" = "windowsx-c.exe"
"WIN32_4" = "System.exe"
"WIN32_5" = "_default64.exe"
"WIN32_6" = "native.exe"
"WIN32_7" = "ux-cryptor.exe"
"WIN32_8" = "crypt0rsx.exe"
Judge/NoCry

The NoCry sample also has the ability to add itself to the startup folder:
$user\$appdata\Microsoft\Windows\Start Menu\Programs\Startup\sPo90bqY4LpMYsfC.exe

Victims

Key Group primarily targets Russian-speaking users. The ransom notes were often written in Russian or included a translation into Russian.

Message from Key Group

About the attackers

The
.huis_bn extension added to encrypted files in the early versions of Key Group samples, Xorist and Chaos, refers to a Russian-speaking closed group “huis”, known in the shadow community. The group primarily conducted spam raids on Telegram channels. We suspect that Key Group is a subsidiary project of the “huis” group. The group is currently inactive and, according to the latest Telegram post, has been rebranded.

Logo of the huis group (source: tgstat.com)

We also checked the GitHub repository from which the ransomware and wipers were downloaded. The account max444432 is subscribed to the account
hxxps://github[.]com/json1c. Its description contains the following contact on Telegram: hxxps://t[.]me/json1c.

Accounts subscribed to max444432 on GitHub

Description of the json1c account on GitHub

The Telegram user Bloody-Lord Destroyer-Crew, also known as “bloody” in the shadow community, was the owner of the “huis” group.

Preview of the @json1c account on Telegram

In the latest versions of the ransomware, the ransom notes listed the Telegram account
@[redacted] (DarkZeus) as a contact, who is one of the administrators of the Key Group channel:

Preview of the account on Telegram

This is a closed Telegram channel. Previously, the group also had an open channel
@[redacted], which the attackers used to communicate with victims; however, it is no longer available. In that channel, the group published news about Key Group, updates from other channels of both technical and ideological nature, leaks from other Telegram sources, and announcements about spam raids.

Invitation link to join the closed Key Group channel

In the GitHub repository used by the attackers to distribute malware, we also found samples of
telegram-raid-botnet.exe (Hakuna Matata) and NoCry, uploaded in February 2024. The name of the first sample resonates with the activities of the “huis” group.

Commits for uploading samples to the RMS2 repository

In one of the ransom notes (MD5: 7E1577B6E42D47B30AE597EEE720D3B1), the attackers asked “not to touch Nikita’s channels, bloody and nacha”, which again indicates a connection to “huis”:
I am the owner of keygroup777 and I was enraged by the work of the telegram technical support, there is no point in paying a ransom, only the contract Pavel Durov if you want to stop it, write
[redacted]and I ask you not to touch Nikita's channels, bloody and nacha will be much worse
time goes by, hello from Root)
and quote Durov, Everything is just beginning - knees will become your only pose.

Takeaways

As we can see, Key Group, like many hacktivists, does not develop its own malware but actively uses leaked ransomware builders, and the primary C2 channel is a GitHub repository, which makes it easy to track their activities. It’s also important to note that ransomware source code is increasingly becoming publicly available, and the number of groups using leaked builders or ransomware source code is on the rise. In the future, it is likely that there will be even more such groups.

Indicators of compromise

from repository hxxps://raw.githubusercontent[.]com/max444432/RMS2/main/:

URLs
hxxp://fastxstreamz.herokuapp[.]com/913915/ndp462-kb3151800-x86-x64-allos-rus.scr?hash=AgADzh
hxxp://fastxstreamz.herokuapp[.]com/913034/setupdjprog-i0w0w04g8gww4ock.exe?hash=agadox
hxxp://fastxstreamz.herokuapp[.]com/912974/3.exe?hash=agadob
hxxps://raw.githubusercontent[.]com/max444432/RMS2/main/*
make-catherine.at.ply[.]gg – C2 XWorm V2.2

securelist.com/key-group-ranso…