Forensic Dissection of Aldet Ransomware: Deconstructing the .aldet Extension and its Makop/Phobos Lineage

When an enterprise network is compromised, the visual footprint left by the ransomware often provides the first critical intelligence regarding the attackers’ operational maturity. The Aldet ransomware makes no attempt at stealth. Upon successful detonation, it overwrites the desktop wallpaper with a stark warning and violently alters the file system, appending a highly descriptive, three-part extension to every encrypted asset. A standard SQL database is not merely locked; it is renamed to include the victim’s uniquely generated hexadecimal ID, the attacker’s direct contact email, and the final .aldet marker.

Discovered during routine heuristic analysis on VirusTotal, endpoint detection systems frequently flag this variant under divergent heuristic identifiers—such as Gen:Variant.Ransom.Makop.168 (Combo Cleaner) and Ransom:Win32/Phobos.PB!MTB (Microsoft). This overlap is not an error; it is forensic confirmation. Aldet is built upon the foundational source code utilized by the Phobos and Makop Ransomware-as-a-Service (RaaS) syndicates. These affiliate groups are infamous for acquiring initial access via compromised RDP endpoints, deploying localized payloads, and extorting small-to-medium enterprises (SMEs) with highly structured, predictable encryption loops.

Furthermore, Aldet enforces a strict double-extortion protocol. The +README-WARNING+.txt manifest explicitly threatens to publish stolen server files online if the cryptocurrency demands are not met. This comprehensive 2,000+ word technical analysis provides Digital Forensics and Incident Response (DFIR) teams with a critical breakdown of the Aldet execution chain, the mathematical realities of its hybrid cryptography, and the advanced data carving strategies utilized by our forensic laboratory to restore corrupted environments without fueling the extortion economy.

1. Threat Intelligence & Artifact Signature Matrix

Successfully mitigating an Aldet infection requires early detection and a precise understanding of its forensic footprint. The payload establishes several highly recognizable system modifications designed to track victims and orchestrate negotiations.

2. Initial Access Vectors: Exploiting Remote Infrastructure

Because Aldet is structurally derived from the Phobos and Makop families, its deployment strategies are highly predictable. These operators rarely rely on zero-day vulnerabilities; instead, they exploit poor administrative hygiene and misconfigured external perimeters.

The RDP Compromise

The vast majority of Makop/Phobos lineage infections originate from compromised Remote Desktop Protocol (RDP) instances. Attackers utilize automated scanning tools (like Masscan or NLBrute) to sweep the IPv4 space for exposed port 3389 connections. Once an exposed portal is identified, they execute relentless credential-stuffing and brute-force attacks against administrative accounts lacking Multi-Factor Authentication (MFA).

Privilege Escalation and Exfiltration

Upon securing a foothold, the attackers log into the server environment manually. Operating as “Human-Operated Ransomware” (HumOR), they utilize tools like Advanced IP Scanner to map the local subnet, Mimikatz to dump memory credentials, and PsExec for lateral movement. Crucially, before executing the .aldet encryptor, they deploy archiving tools (such as WinRAR) and utilize cloud synchronization utilities (like Rclone) to exfiltrate critical corporate data to remote drop servers—fulfilling the double-extortion threat outlined in their ransom note.

3. The Cryptographic Architecture: AES and RSA Key Wrapping

To lock enterprise files effectively, Aldet employs a robust hybrid encryption model. While the visual indicators are loud, the underlying mathematics are strictly enterprise-grade.

The Hybrid Cipher Pipeline

For every targeted document, image, and database file, Aldet generates a temporary, unique symmetric key (typically utilizing the AES-256 algorithm). This symmetric key scrambles the raw data blocks of the file, transforming the Plaintext ($P_i$) into Ciphertext ($C_i$):

To prevent local extraction of this symmetric key, the malware utilizes an asymmetric public key (RSA-1024 or RSA-2048) embedded directly into the malware’s binary code. The unique symmetric key is mathematically wrapped by this public key:

The resulting encrypted data blob ($K_{enc}$) is appended directly to the end of the newly formed .aldet file as metadata. The complex filename structure—incorporating the victim ID and email—acts as an administrative index for the attackers, allowing them to match the victim to the correct private RSA key stored on their offshore servers.

4. Evasion and Anti-Recovery Mechanisms

To ensure victims cannot use built-in Windows rollback features, the Aldet payload spawns hidden command-line threads to execute destructive administrative functions immediately prior to starting the encryption loop:

vssadmin.exe delete shadows /all /quiet
wmic.exe shadowcopy delete
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
bcdedit.exe /set {default} recoveryenabled No

Concurrently, the malware scans active process lists to forcefully terminate enterprise database services (such as MS SQL, Oracle, and Exchange) and backup agents. This releases active file locks, ensuring that mission-critical databases are completely accessible to the encryption engine.

5. Verbatim Ransom Note Reference Log

To confirm that your infrastructure has been compromised by this specific variant, verify that the +README-WARNING+.txt file dropped on your desktops matches the exact syntax transcribed below:

6. Enterprise Incident Containment Playbook

If an organization detects an active Aldet intrusion, IT leadership must execute a strict, immediate containment playbook to limit data damage and preserve valuable forensic artifacts:

1. Network Boundary Isolation: Disconnect infected workstations and servers from local network switches immediately. Pull physical Ethernet lines. If managing virtualized data centers (such as VMware ESXi), isolate the affected Virtual Local Area Networks (VLANs) at the hypervisor level to halt lateral propagation without powering down the affected VMs.
2. Live Volatile Memory (RAM) Capture: Do not initiate a hard shutdown. Rebooting a system flushes the volatile memory, permanently erasing raw cryptographic keys, unencrypted process parameters, and vital execution logs. Run a write-blocked memory capture tool (like DumpIt) to extract the active system RAM.
3. Terminate Cryptographic Processes: Utilize elevated administrative tools (like Process Explorer) to locate the malicious executable running from anomalous directories. Right-click the parent binary and execute a Kill Process Tree command to halt active disk writes immediately.

7. Institutional Laboratory Recovery Vectors

Recovering from a Makop/Phobos derivative ransomware attack without financing cybercriminal syndicates requires sterile, lab-controlled data restoration methodologies:

• Sector-Level Drive Cloning: All physical and virtual disks are mirrored sector-by-sector using hardware write-blockers. All dynamic analysis, reverse-engineering, and file carving tasks are conducted exclusively on these lab copies to maintain absolute evidence integrity.
• Unallocated Space Carving: Because ransomware frequently operates by reading a file, encrypting it in memory, writing the new .aldet file to disk, and then deleting the original, vast quantities of original files may still exist in the unallocated sectors of the MFT (Master File Table). Laboratory engineers utilize deep byte-level hex carving to extract these pristine files directly from the physical disk platters.
• Database Page Reconstruction: For massive corporate assets like Microsoft SQL Server files (.mdf), the encryption engine often utilizes partial encryption—modifying only specific block offsets. Laboratory engineers strip away the corrupted header blocks, parse the remaining structure, and map the raw tables into a fresh database wrapper, successfully recovering critical relational data.