8 minhigh
Files Locked Behind a White Padlock: A Warning from WhiteLock Ransomware
WhiteLock is a Windows ransomware that encrypts user files using AES-CBC symmetric encryption with RSA-2048 asymmetric key protection, appending the .Fbin extension to encrypted files. It identifies infected devices via SHA-256 hashed MAC addresses, communicates with external servers for key exchange, and deliberately terminates AnyDesk and TeamViewer services to impede remote incident response. The ransomware has been observed in campaigns where information theft malware is used for initial access prior to ransomware deployment.
Sens:▲ 24hConf:
Showing defanged values
- filenamec0ntact.TxtRansom note created by WhiteLock ransomware at the root path of each drive, containing Tor-based negotiation page instructions and victim identification requirements
Detection / Hunteropenrouter
What Happened
A new type of malicious software called WhiteLock has been discovered that locks up files on Windows computers and demands payment to unlock them. When it infects a computer, it scrambles the files so they cannot be opened, adds '.Fbin' to the end of each locked file name, and leaves a note called 'c0ntact.Txt' telling the victim how to pay. It also deliberately shuts down popular remote-access programs like AnyDesk and TeamViewer, making it harder for IT staff to fix the problem remotely. In some cases, attackers first steal information from the victim before deploying this ransomware. Anyone using Windows should keep their security software updated, maintain offline backups of important files, and monitor for unusual activity on their systems.
Key Takeaways
- WhiteLock ransomware encrypts files on Windows systems using AES-CBC with RSA-2048 key protection, appending the .Fbin extension to encrypted files
- The ransomware terminates AnyDesk and TeamViewer services to hinder remote incident response by administrators and security personnel
- WhiteLock collects the MAC address of the infected device, hashes it with SHA-256, and uses it for device identification when communicating with an external C2 server
- Some infections involve information theft malware used for initial breach prior to WhiteLock deployment, indicating a multi-stage attack chain
- Ransom note c0ntact.Txt is dropped at the root of each drive, directing victims to a Tor-based negotiation page
Affected Systems
- Windows systems
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Information theft malware used for initial breach in some confirmed cases, followed by WhiteLock ransomware deployment
- Discovery & Preparation: WhiteLock collects MAC address, computes SHA-256 hash for device identification, and checks for AnyDesk and TeamViewer installations
- C2 Communication: Ransomware communicates with external server using hashed MAC address for victim registration and retrieves RSA-2048 public key; encrypted AES key is transmitted to server
- Defense Evasion: AnyDesk and TeamViewer-related services are terminated to prevent remote incident response
- Impact: Files are encrypted using AES-CBC with the generated key and IV; .Fbin extension appended; ransom note c0ntact.Txt created at drive root; desktop wallpaper changed to display ransom message
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: AhnLab V3, AhnLab EDR, AhnLab MDP
AhnLab provides file-based detection, behavior-based detection, and EDR detection for WhiteLock. Detailed IOCs are available via AhnLab TIP subscription. No rule content is reproduced in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect bulk file modifications, ransom note creation, service termination of remote access tools, and abnormal external communications. However, the article does not specify whether EDR captures the initial MAC address collection or the C2 key exchange traffic in detail. |
| Network Visibility | Medium | The ransomware communicates with external servers for device registration and RSA key exchange, which could be detected via network monitoring. However, no specific C2 domains or IPs are provided in the article for blocking or alerting. |
| Detection Difficulty | Moderate | Behavioral indicators such as mass file encryption, .Fbin extension creation, c0ntact.Txt ransom note generation, and termination of AnyDesk/TeamViewer services are detectable with EDR. However, without published IOCs (IPs, domains, hashes), network-based detection is limited. |
Required Log Sources
- Endpoint process creation logs
- File modification logs
- Windows Service control logs
- Network connection logs
- DNS resolution logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for processes that terminate AnyDesk or TeamViewer-related Windows services in rapid succession, which may indicate ransomware attempting to impede remote response (T1562.001) | Windows Service Control Manager (SCM) event logs, EDR process termination events | Defense Evasion | Medium — legitimate administrative scripts or IT management tools may stop these services during maintenance windows |
| Consider hunting for processes that perform bulk file modifications across multiple directories while appending an unusual file extension, consistent with ransomware encryption behavior (T1486) | File system audit logs, EDR file modification telemetry | Impact | Low — bulk file modification with extension renaming is rarely legitimate, though file archiving or backup tools could trigger similar patterns |
| Consider hunting for processes that create a file named c0ntact.Txt at the root of multiple drives, which is the WhiteLock ransom note placement behavior | File system audit logs, EDR file creation events | Impact | Low — this specific filename at drive roots is highly indicative of WhiteLock ransomware activity |
| Consider hunting for processes that collect the MAC address and compute a SHA-256 hash early in execution, followed by outbound network communication, which may indicate ransomware device registration with C2 (T1049, T1071) | EDR process telemetry, network connection logs, DNS logs | Discovery and C2 | Medium — legitimate software inventory and asset management tools may collect MAC addresses and communicate externally |
Control Gaps
- Signature-based antivirus alone may not detect novel WhiteLock variants without published file hashes
- Network-based detection is limited without specific C2 IP or domain IOCs, which are only available via AhnLab TIP subscription
- If remote access tools are terminated by the ransomware, out-of-band management channels may be needed for incident response
Key Behavioral Indicators
- Process performing mass file renames appending .Fbin extension across user directories
- Creation of c0ntact.Txt at root of multiple drives
- Termination of AnyDesk and TeamViewer-related Windows services by an unexpected process
- Process collecting MAC address followed by outbound network communication and subsequent bulk file encryption
- Desktop wallpaper change to a ransom message image
False Positive Assessment
Low — the combination of .Fbin extension creation, c0ntact.Txt ransom note generation, and termination of AnyDesk/TeamViewer services is highly specific to WhiteLock ransomware behavior. Individual indicators such as service termination may have legitimate causes, but the full behavioral pattern is strongly indicative of compromise.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoints for files with the .Fbin extension and the ransom note c0ntact.Txt to identify potential WhiteLock infections
- If your EDR supports host isolation, consider isolating any systems exhibiting mass file encryption behavior or unexpected termination of remote access tool services
- Consider blocking outbound communications from suspected infected systems to prevent AES key transmission to attacker-controlled servers
Infrastructure Hardening
- Consider implementing network segmentation to limit lateral movement opportunities if WhiteLock is deployed following an initial breach
- Evaluate whether remote access tools such as AnyDesk and TeamViewer can be monitored for unexpected service termination events, and consider alerting on such behavior
- Consider maintaining offline or immutable backups of critical data to enable recovery without paying ransom
User Protection
- Consider deploying behavior-based detection through EDR to identify ransomware-like file encryption patterns, service termination, and abnormal external communications
- Ensure antivirus engines and endpoint detection signatures are kept up to date
- Consider monitoring for phishing and account compromise indicators, as WhiteLock infections may follow initial information theft malware deployment
Security Awareness
- Consider incorporating ransomware awareness training that emphasizes reporting unexpected file extension changes or ransom notes immediately
- Consider reminding staff not to use remote access tools as the sole means of incident response, as ransomware may terminate these services deliberately
- Consider reviewing policies on remote access tool usage and ensuring alternative response channels exist
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping6 techniques
Tactic
Stealth
Tactic
Discovery
Tactic
Command and Control
Additional IOCs
- File Paths:
c0ntact.Txt- Ransom note dropped at root of each drive by WhiteLock ransomware
- Other:
.Fbin- File extension appended to all files encrypted by WhiteLock ransomware; used as a marker to prevent re-encryption of already processed files