Multiple attackers increase pressure on victims, complicate incident response

guest · Aug 12, 2022

Simultaneous ransomware attacks detailed
August 12, 2022

Sophos researchers have discovered that the LockBit, Hive, and BlackCat ransomware operations have simultaneously attacked an unnamed organization, ZDNet reports.

After being subjected to a suspected intrusion from an initial access broker that established a remote desktop protocol session last December, the organization's network was infiltrated by a LockBit ransomware affiliate through vulnerable RDP instance in April, the report revealed.
Click to expand...

Nineteen or more systems have been deployed with ransomware by the LockBit affiliate before a Hive ransomware affiliate suspected to use the same RDP credentials worked to immediately encrypt systems. BlackCat attackers were observed to infiltrate the network two weeks later, with the threat actors not only spreading ransomware but also concealing its activities, alongside the attack of LockBit and Hive.

"It's bad enough to get one ransomware note, let alone three. Multiple attackers create a whole new level of complexity for recovery, particularly when network files are triple encrypted. At some point, these groups will have to decide how they feel about cooperation whether to further embrace it or become more competitive but, for now, the playing field is open for multiple attacks by different groups," said Sophos Senior Security Advisor John Shier.
Click to expand...

Sophos: Multiple attackers increase pressure on victims, complicate incident response

Sophos’ latest Active Adversary report explores the issue of organizations being hit multiple times by attackers
There’s a well-worn industry phrase about the probability of a cyberattack: “It’s not a matter of if, but when.” Some of the incidents Sophos recently investigated may force the industry to consider changing this rule-of-thumb: The question is not if, or when – but how many times?

In an issue we highlighted in our Active Adversary Playbook 2022, we’re seeing organizations being hit by multiple attackers. Some attacks take place simultaneously; others are separated by a few days, weeks, or months. Some involve different kinds of malware, or double – even triple – infections of the same type.
Click to expand...

Today, Sophos X-Ops is releasing our latest Active Adversary white paper: Multiple Attackers: A Clear and Present Danger.
Click to expand...

White paper: https://assets.sophos.com/X24WTUEQ/at/q6r6n3x43mnrfchn5tfh3qmw/sophos-x-ops-active-adversary-multiple-attackers-wp.pdf

guest · Aug 12, 2022

Automotive supplier breached by 3 ransomware gangs in 2 weeks
August 10, 2022

An automotive supplier had its systems breached and files encrypted by three different ransomware gangs over two weeks in May, two of the attacks happening within just two hours.

The attacks followed an initial breach of the company's systems by a likely initial access broker (IAB) in December 2021, who exploited a firewall misconfiguration to breach the domain controller server using a Remote Desktop Protocol (RDP) connection.
Click to expand...

While dual ransomware attacks are increasingly common, "this is the first incident we've seen where three separate ransomware actors used the same point of entry to attack a single organization," Sophos X-Ops incident responders said in a report published Wednesday.
Breached three times within two months
After the initial compromise, LockBit, Hive, and ALPHV/BlackCat affiliates also gained access to the victim's network on April 20, May 1, and May 15, respectively.

On May 1, LockBit and Hive ransomware payloads were distributed across the network using the legitimate PsExec and PDQ Deploy tools within two hours to encrypt more than a dozen systems during each attack (the LockBit affiliate also stole data and exfiltrated it to the Mega cloud storage service.

"Because the Hive attack started 2 hours after Lockbit, the Lockbit ransomware was still running – so both groups kept finding files without the extension signifying that they were encrypted," Sophos X-Ops added.
Click to expand...

Two weeks later, on May 15, while the automotive supplier's IT team was still restoring systems, a BlackCat threat actor also connected to the same management server compromised by LockBit and Hive.
Last man out locks the door
By deleting shadow copies and clearing out the Windows Event Logs on the compromised systems, this last attacker also complicated recovery attempts and the Sophos team's incident response efforts.

"In fact, as shown in the screenshot below, some files had even been encrypted five times," the Sophos team said.
Click to expand...

Sophos: Lockbit, Hive, and BlackCat attack automotive supplier in triple ransomware attack

After gaining access via RDP, all three threat actors encrypted files, in an investigation complicated by event log clearing and backups. 3 attackers, 2 weeks – 1 entry point.
Click to expand...

Log in or Sign up

Multiple attackers increase pressure on victims, complicate incident response

guest Guest

guest Guest

Log in or Sign up

Multiple attackers increase pressure on victims, complicate incident response

guest Guest

guest Guest

Useful Searches