30 Mins or Less: Rapid Attacks Extort Orgs Without Ransomware

guest · Oct 13, 2021

30 Mins or Less: Rapid Attacks Extort Orgs Without Ransomware
October 13, 2021
https://threatpost.com/rapid-attacks-extort-ransomware/175445/

In less time than it takes to get a stuffed crust pizza delivered, a new group called SnapMC can breach an organization’s systems, steal their sensitive data, and demand payment to keep it from being published, according to a new report from NCC Group’s threat intelligence team — no ransomware required.

Rather than disrupting business operations by locking down a target’s data and systems, SnapMC just focuses on straight-up extortion. However, this low-tech, ransomware-free approach to extortion on a compressed timeline relies on known vulnerabilities with patches readily available.

“In the extortion emails we have seen from SnapMC have given victims 24 hours to get in contact and 72 hours to negotiate,” the report said. “These deadlines are rarely abided by, since we have seen the attacker to start increasing the pressure well before countdown hits zero.”
Click to expand...

Analysts said they’ve observed SnapMC successfully breaching unpatched and vulnerable VPNs using the CVE-2019-18935 remote code execution bug in Telerik UI for ASPX.NET, and webserver apps using SQL injections.
“While VPN solutions have their place, there have been multiple stories of vulnerabilities within these solutions that were exploited in the wild,” Schless explained to Threatpost.
Click to expand...

NCC Group: SnapMC skips ransomware, steals data

First, initial access was generally achieved through known vulnerabilities, for which patches exist. Patching in a timely manner and keeping (internet connected) devices up-to-date is the most effective way to prevent falling victim to these types attacks. Make sure to identify where vulnerable software resides within your network by (regularly performing) vulnerability scanning.

Worth mentioning, when reference testing the exploitability of specific versions of Telerik it became clear that when the software component resided behind a well configured Web Application Firewall (WAF), the exploit would be unsuccessful.
Click to expand...

NCC Group’s Threat Intelligence team predicts that data breach extortion attacks will increase over time, as it takes less time, and even less technical in-depth knowledge or skill in comparison to a full-blown ransomware attack.
Click to expand...

Log in or Sign up

30 Mins or Less: Rapid Attacks Extort Orgs Without Ransomware

guest Guest

Log in or Sign up

30 Mins or Less: Rapid Attacks Extort Orgs Without Ransomware

guest Guest

Useful Searches