# Ransomware affiliate exploits EarthTime flaw, deploys three malware families

Published: 2025-09-08 · Severity: routine · Sectors: technology, financial-services, healthcare
Canonical: https://vorant.io/reports/6e001f80-6145-5ce6-b84e-ca536da476f0/ransomware-affiliate-exploits-earthtime-flaw-deploys-three-malware-families

> An intrusion chain delivering SectopRAT, SystemBC, and Betruger suggests a ransomware affiliate operating across Play, RansomHub, and DragonForce.

In September 2024, an intrusion began with a malicious executable impersonating DeskSoft's EarthTime application, exploiting a search-path vulnerability (CWE-427) in the installer to drop SectopRAT malware. The threat actor established persistence via startup folder shortcuts and created a local admin account (Admon). After initial access, SystemBC was deployed for proxy tunneling, enabling lateral movement via RDP and PsExec across domain controllers, backup servers, and file servers. The attacker conducted extensive reconnaissance using Grixba (linked to Play ransomware), AdFind, SharpHound, SoftPerfect NetScan, and Impacket's wmiexec. They harvested credentials through information-stealing, Veeam database dumping via PowerShell, and DCSync attacks. On day six, Betruger backdoor was deployed—a multi-function tool used by RansomHub affiliates. Data collection involved WinRAR compression of sensitive file shares, transferred via unencrypted FTP to a U.S. cloud provider. While ransomware deployment was not observed before the attacker was evicted, forensic evidence—including Grixba tooling, Betruger backdoor, and recovered NetScan output containing data from a DragonForce victim—indicates the threat actor was likely a ransomware affiliate operating across multiple gangs.

## Detection guidance (public sample)

### Local Administrator Account Created and Added to Administrators Group

ATT&CK: T1136.001

Detects net.exe/net1.exe creating a local user and adding it to the local Administrators group, as seen with the attacker-created local admin account after initial access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Local Administrator Account Created and Added to Administrators Group
description: Detects net.exe or net1.exe commands that create a local user account
  or add a user to the local Administrators group. Generalises on the command pattern,
  NOT the specific account name.
tags:
- attack.persistence
- attack.t1136.001
- attack.t1078.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \net.exe
    - \net1.exe
  selection_create:
    CommandLine|contains|all:
    - ' user '
    - ' /add'
  selection_group:
    CommandLine|contains|all:
    - localgroup
    - administrators
    - ' /add'
  condition: selection_img and (selection_create or selection_group)
falsepositives:
- IT provisioning scripts creating local service or break-glass admin accounts
- Imaging or deployment tasks that add a local admin during build
level: medium
id: b59ccc68-e607-51a6-aec5-5284b4285df2
status: experimental
author: Vorant
references:
- https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs
```

### PsExec Service Named Pipes Used for Lateral Movement

ATT&CK: T1021.002

Detects creation of PsExec-style named pipes, used by the attacker for lateral movement across domain controllers, backup and file servers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PsExec Service Named Pipes Used for Lateral Movement
description: Detects creation of named pipes characteristic of PsExec and clones (PSEXESVC,
  csexec and the -stdin/-stdout/-stderr pipes) on hosts receiving remote service execution.
tags:
- attack.lateral-movement
- attack.t1021.002
- attack.t1570
logsource:
  category: pipe_created
  product: windows
detection:
  selection_prefix:
    PipeName|startswith:
    - \PSEXEC
    - \csexec
  selection_suffix:
    PipeName|endswith:
    - -stdin
    - -stdout
    - -stderr
  condition: 1 of selection_*
falsepositives:
- Sanctioned administrators using PsExec for remote management
- Software deployment or patching tooling that wraps PsExec
level: medium
id: 68c3845d-6d5e-5596-aba8-e7e44a1120f6
status: experimental
author: Vorant
references:
- https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs
```

### Startup Folder Shortcut Created by Non-Standard Process

ATT&CK: T1547.001

Detects .lnk files written to a user or all-users Startup folder by a process other than common installers, matching the startup-folder persistence used for SectopRAT. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Startup Folder Shortcut Created by Non-Standard Process
description: Detects creation of shortcut (.lnk) files in the Windows Startup folder
  by processes other than explorer or installers, a persistence technique used to
  relaunch the dropped RAT at logon.
tags:
- attack.persistence
- attack.t1547.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\Startup\
    TargetFilename|endswith: .lnk
  filter_benign:
    Image|endswith:
    - \explorer.exe
    - \msiexec.exe
    - \OneDriveSetup.exe
    - \setup.exe
  condition: selection and not filter_benign
falsepositives:
- Legitimate application installers placing startup shortcuts via custom setup binaries
- Users or admins manually scripting startup shortcuts
level: medium
id: 94d74c5d-77b4-58fb-8dc7-e4fd90a3c45a
status: experimental
author: Vorant
references:
- https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6e001f80-6145-5ce6-b84e-ca536da476f0/ransomware-affiliate-exploits-earthtime-flaw-deploys-three-malware-families.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup