CERT NZ Releases Advisory on Ransomware Campaign

guest · Jun 18, 2020

CERT NZ Releases Advisory on Ransomware Campaign
June 18, 2020
https://www.us-cert.gov/ncas/curren...cert-nz-releases-advisory-ransomware-campaign

The New Zealand Computer Emergency Response Team (CERT NZ) has released an advisory on a ransomware campaign leveraging remote access technologies. Malicious cyber actors are targeting organizations’ networks through remote access tools, such as Remote Desktop Protocol and virtual private networks, to exploit unpatched vulnerabilities and weak authentication.

After gaining access, cyber actors use various tools—including mimikatz, PsExec, Cobalt Strike, and Nefilim ransomware—for privilege escalation, lateral movement, persistence, and data exfiltration and encryption. Due to the level of access gained before deploying ransomware, the issue cannot be resolved by simply restoring data from backup.
Click to expand...

The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the CERT NZ Advisory, Active Ransomware Campaign Leveraging Remote Access Technologies, for more information and mitigations as well as indicators of compromise associated with Nefilim ransomware. CISA also encourages organizations to review the following resources for more information on protecting against and responding to ransomware.

CISA Resource Page: Ransomware

CISA Insights: Ransomware Outbreak
https://www.us-cert.gov/sites/default/files/2019-08/CISA_Insights-Ransomware_Outbreak_S508C.pdf

CISA Security Tip: Protecting Against Ransomware

Click to expand...

guest · Jun 23, 2020

Nefilim Ransomware Gang Tied to Citrix Gateway Hacks
Campaign Targets Unpatched Software and Weak Authentication, Defenders Warn
June 22, 2020
https://www.databreachtoday.com/nefilim-ransomware-gang-tied-to-citrix-gateway-hacks-a-14480

A crime gang seeking "ransomware attack opportunities" is targeting organizations that use unpatched or poorly secured Citrix remote-access technology, then stealing data, unleashing crypto-locking malware and using the threat of exfiltrated data being publicly dumped to try to force payment, New Zealand's national computer emergency response team warns.

In an alert issued last week, and subsequently amplified by the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency, CERT NZ says that a "sophisticated and well-crafted" attack campaign has been hitting unprepared organizations with Nefilim - aka Nephilim - ransomware.

"Nefilim emerged in March 2020 and shares a substantial portion of code with another ransomware family, Nemty," security firm AlienVault notes. "Nefilim is another family which has very quickly risen to prominence with multiple damaging campaigns that threaten to publish victims' sensitive information in the event they fail to 'cooperate' with the attacker's demands."
Click to expand...

Trend Micro, in an analysis of an attempted attack by the Nefilim gang against one of its customers in March, noted that among the various tricks and tactics used by attackers, they relied on PsExec to try to remotely execute commands in the victim's network.

"What can be observed from this incident is that the threat actors behind it are not just relying on Nefilim alone," Trend Micro said in its analysis. "They might already have exfiltrated the data even before they launched a full-on ransomware attack."
Click to expand...

Log in or Sign up

CERT NZ Releases Advisory on Ransomware Campaign

guest Guest

guest Guest

Log in or Sign up

CERT NZ Releases Advisory on Ransomware Campaign

guest Guest

guest Guest

Useful Searches