Attackers Combine Attacks Against RDP with Ransomware

guest · Sep 27, 2019

Attackers Combine Attacks Against RDP with Ransomware
September 26, 2019
https://duo.com/decipher/attackers-combine-attacks-against-rdp-with-ransomware

Ransomware attacks are increasingly using the Remote Desktop Protocol as the initial entry vector, taking advantage of the fact that many enterprises struggle to balance the risks of exposing RDP and the advantages of being able to access machines in multiple locations.

The Institute for Critical Infrastructure and Technology highlighted the growing use of ransomware and other types of “disruptionware” in 2019 against critical infrastructure and industrial networks. Adversaries targeting operational technology (OT) environments with attacks that are designed to disrupt business operations pose “an existential threat to critical infrastructure operators,” ICIT wrote in its paper.

During the course of a ransomware attack, the attackers may use the exposed RDP ports to continue causing more damage, the authors suggested in the paper.

“While the victim is deciding whether or not to pay the ransom, the adversary retains access to the system, allowing them to install backdoors, remote access Trojans, or other malware that can facilitate future attacks or provide access-as-a-service to other attackers,” ICIT wrote.
Click to expand...

ICIT: The Rise of Disruptionware: A Cyber-Physical Threat to Operational Technology Environments
(PDF - 2.03 MB): https://icitech.org/wp-content/uploads/2019/09/ICIT-Brief-The-Rise-of-Disruptionware-1.pdf

guest · Aug 24, 2020

Iranian hackers attack exposed RDP to deploy Dharma ransomware
August 24, 2020
https://www.bleepingcomputer.com/ne...tack-exposed-rdp-to-deploy-dharma-ransomware/

Low-skilled hackers likely from Iran have joined the ransomware business targeting companies in Russia, India, China, and Japan. They are going after easy hits, using publicly available tools in their activity.

The new group is deploying Dharma ransomware. Based on forensic artifacts, this is a non-sophisticated, financially-motivated gang that is new to cybercrime.
Amateur hackers at work
The threat actor is not greedy. Their demand is between 1-5 Bitcoin (currently $11,700 - $59,000), which is on the lower range of ransom demand compared to other ransomware operations.
They find victims by scanning IP address ranges on the internet for exposed remote desktop connections (RDP); their tool of choice for this stage is Masscan, an open-source port scanner.

“Interestingly, the threat actors likely didn’t have a clear plan on what to do with the compromised networks. Once they established the RDP connection, they decide on which tools to deploy to move laterally,” Group-IB
Click to expand...

Group-IB: Cybercriminal greeners from Iran attack companies worldwide for financial gain

For instance, to disable built-in antivirus software, the attackers used Defender Control and Your Uninstaller.

To scan for accessible hosts in the compromised network, threat actor used Advanced Port Scanner — another publicly available tool. After the network reconnaissance activities were completed, the adversary used collected information to move laterally though the network using the RDP protocol.
The end goal of the attackers was to drop and execute a variant of Dharma ransomware: the adversary connected to the targeted hosts, dropped Dharma executable, and executed it manually.
Click to expand...

Log in or Sign up

Attackers Combine Attacks Against RDP with Ransomware

guest Guest

guest Guest

Log in or Sign up

Attackers Combine Attacks Against RDP with Ransomware

guest Guest

guest Guest

Useful Searches