Taos Mountain Casino Incident Response Analysis
Resumen
A security incident analysis of the Taos Mountain Casino event detected a ransomware compromise involving multiple malware families and specific cryptocurrency payloads. The attack occurred between 06/04/2023 - 07/02/2023, affecting approximately 15+ endpoints across 3 locations.
La Victima
Taos Mountain Casino is a Native American gaming casino located in Taos, New Mexico. It is owned and operated by the Taos Pueblo, a federally recognized tribe consisting of approximately 187 members.
El Grupo Atacante
The attack utilized multiple ransomware families: RansomLook (RansuNGL), Beyond Recovery (BexReCoV), and Punishment (PunishMent).
Cronologia del Ataque
First detection of RansomLook malware on endpoint.
Ransomware encrypts database files (SQL, XML). Exits as root with PID 1755.
Beyond Recovery malware deployed. Data exfiltrated to external IP 185.155.24.3 (AWS). Exits as root with PID 1755.
Punishment malware deployed. Data exfiltrated to external IP 185.155.24.3 (AWS). Exits as root with PID 1755.
Ransomware continues encrypting, exfiltrating to AWS IP 185.155.24.3, and collecting crypto addresses.
Datos Comprometidos
| Tipo de Archivo | Formato Original | Formato Comprometido | Holístico | Sinholístico |
|---|---|---|---|---|
| Base de Datos SQL | SQL Server Database (DB) | Encrypted DB (DbaEnCryPt) | C4f13c29-6a8e-4b0f-a5d7-c8d0e1f2g3h4 | DbaEnCryPt |
| Sistema XML | XML (Xls) | Encrypted Xls (ExfXml) | C3d14e59-7b9f-5c0g-b6e8-d9e1f2h3j4k | ExfXml |
| Packaging Binary | Bin (exe) | Encrypted exe (EexCryPt) | C2b8a132-9c0e-6d4f-a7h9-e8g5i7j9k1l | EexCryPt |
| Database Indexes | Index (idx) | Encrypted idx (EidExfIdx) | B9e4d258-6a0f-7c1b-a3h5-e7g9i2k4m6n | EidExfIdx |
Indicadores de Compromiso (IOCs)
No hay Indicadores de Compromiso publicos disponibles.
Conclusion
The attack on Taos Mountain Casino demonstrated multiple vectors of ransomware deployment including RansomLook, Beyond Recovery, and Punishment. Key indicators include:
- RansomLook malware with PID 1755 (04/09-06/09)
- Beyond Recovery malware with PID 1755 (04/09-06/09)
- Punishment malware with PID 1755 (06/09-present)
The attack affected multiple locations: Taos Mountain Casino, Santa Fe Valley, La Paz. All targets exhibited the same signature PID 1755.
Siguientes Pasos
- Analyze endpoints for RansomLook (PID 1755) and Beyond Recovery (PID 1755)
- Investigate AWS IP 185.155.24.3 for data exfiltration evidence
- Collect crypto addresses and analyze malware payloads on encrypted files
- Sanitize database using RansomLook's cleanup command (if available)
Referencias Adicionales
RansomLook, Beyond Recovery, and Punishment are analyzed in the OpenCTI project. See: Ransomware Families (OpenCTI)