Ransomware Targets SMBs via RDP Attacks

itman · Nov 19, 2017

This technique appears to be the preferred method to hack corp. networks based on the recent postings on ransomware infections I have seen. That is RDP brute force attacks. Now for the "good part." When the victims were advised to lock down their RDP ports, the response has been they won't do it lest they block client connections.

-EDIT- A specific recent example:

Unfortunately we are unable to close port 3389 as we provide a service to our clients that require the RDP to our terminal servers. We have to consider an alternative in the near future to prevent this from happening again,
Click to expand...

https://forum.eset.com/topic/13651-powershell-script-possible-malicious-attack/

A series of ransomware attacks against small-to-medium companies are leveraging Remote Desktop Protocol (RDP) access to infect systems, Sophos reports.

As part of these attacks, the mallicious actors abuse a commonly found issue in many business networks: weak passwords. After managing to crack and RDP password, attackers can easily install their malware onto the company’s systems with hopes to collect a ransom payment.

Discovering RDP ports exposed to the Internet isn’t difficult at all, Sophos explains. Cybercriminals can use specialized search engines such as Shodan for that and then abuse public or private tools to gain access to the discovered systems.

As part of the analyzed attacks, the actors used a tool called NLBrute to brute-force their way into the found systems by trying a variety of RDP passwords. Once they managed to find the right password, the attackers would immediately log into the network and create their own administrative accounts, Sophos says.

By doing so attackers can reconnect to the network even if the admin password they used for initial compromise has been changed. “They’ve already got backup accounts they can use to sneak back in later,” the researchers say.

Next, the attackers download and install low-level system tweaking software, such as Process Hacker, after which they turn off or reconfigure anti-malware applications. They also attempt to elevate privileges through abusing known vulnerabilities, including the CVE-2017-0213 and CVE-2016-0099 flaws that have been long patched by Microsoft.
Click to expand...

http://www.securityweek.com/ransomware-targets-smbs-rdp-attacks

Log in or Sign up

Ransomware Targets SMBs via RDP Attacks

itman Registered Member

Log in or Sign up

Ransomware Targets SMBs via RDP Attacks

itman Registered Member

Useful Searches