Threat video1:00
Rook Ransomware (.Rook) Babuk-Derived: Detection & IOCs
FortiGuard first documented Rook in 2021 as a Babuk-derived encryptor. 9 detection rules, 17 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for Rook Ransomware (.Rook) Babuk-Derived: Detection & IOCs →
Chapters
- 0:00The hookRook ransomware attacked banks worldwide.
- 0:04The storyFirst appeared November 2021.
- 0:10Attack pathReportedly launched, then halted services.
- 0:20AttributionAttributed to Cinnamon Tempest.
- 0:24Indicators of compromise11 indicators to hunt: 3 SHA-256 hashes, 3 SHA-1 hashes and 1 MD5 hash, and more.
- 0:34MITRE ATT&CK techniques16 ATT&CK techniques, from initial access to impact.
- 0:38Remediation3 steps now: Hunt for HowToRestoreYourFiles.txt, *.Rook files and HKCU\Software\RookPublicKey / RookPrivateKey registry.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Rook ransomware attacked banks worldwide.
0:05First appeared November 2021.
0:10Reportedly launched, then halted services.
0:13Deleted backup copies, encrypted files.
0:16Dropped ransom notes.
0:20Attributed to Cinnamon Tempest. Confidence: medium.
0:2411 indicators to hunt: 3 SHA-256 hashes, 3 SHA-1 hashes and 1 MD5 hash, and more.
0:3416 ATT&CK techniques, from initial access to impact.
0:383 steps now: Hunt for HowToRestoreYourFiles.txt, *.Rook files and HKCU\Software\RookPublicKey / RookPrivateKey registry.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.