How to thwart human-operated ransomware campaigns?
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0604 | RCE in Microsoft SharePoint via Application Package Markup Validation Flaw Microsoft SharePoint fails to check the source markup of an application package, an improper input validation flaw (CWE-20) that allows maliciously crafted markup to be processed by the server. An attacker triggers the flaw by getting an affected SharePoint server to handle a crafted application package, without any special privileges described in the disclosure. Successful exploitation lets the attacker run remote code in the context of the SharePoint application pool and the SharePoint server farm account, providing control of the web server and access to a highly privileged farm-level identity. Any organization running an affected on-premises Microsoft SharePoint deployment is exposed, with internet-facing SharePoint servers at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and EPSS puts the probability of exploitation at 99.9%, although no public proof-of-concept is catalogued. Do: Apply Microsoft's SharePoint security updates per vendor instructions immediately, prioritizing internet-exposed SharePoint servers as CISA's required action directs. Given known in-the-wild and ransomware use, hunt for signs of compromise such as unexpected .aspx or webshell files in SharePoint directories and anomalous use of the SharePoint farm account. Restrict or firewall internet exposure of SharePoint servers until patches are confirmed applied. | 9.8 | 100% | KEV ransomware |
| mass≈ hundreds of thousands of on-prem SharePoint server deployments worldwide, of which tens of thousands are directly internet-facing (estimate) | |
| CVE-2019-11510 | Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN Ivanti Pulse Connect Secure, an enterprise SSL VPN appliance, contains an arbitrary file read vulnerability (CWE-22, path traversal) that requires no authentication. An unauthenticated remote attacker with network access to the appliance over HTTPS can send a specially crafted URI containing traversal sequences to read arbitrary files from the device. The attacker gains access to sensitive appliance files, potentially including configuration or credential material useful for further compromise, and CISA records known ransomware use of this flaw. Any organization running Pulse Connect Secure, especially gateways exposed to the internet for remote access, is affected. Exploitation is established: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation in the next 30 days, and no public PoC is known. Do: Apply updates per Ivanti's instructions, the required action in the CISA KEV entry, prioritizing internet-facing Pulse Connect Secure gateways, and consult the vendor advisory for the applicable fixed release since no version range is provided here. Where patching is not immediate, restrict HTTPS access to the appliance and hunt for signs of exploitation (unexpected file reads, anomalous VPN logins or sessions, and follow-on ransomware activity), as CISA reports known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×2 |
| largeTens of thousands of internet-exposed gateways (order of 10,000-100,000 systems; each typically serves hundreds of VPN users, so potentially millions of users) | |
| CVE-2019-1978 | A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Ma A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to improper reassembly of traffic streams. An attacker could exploit this vulnerability by sending crafted streams through an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious requests to protected systems that would otherwise be blocked. NVD description · AI analysis pending | 5.8 | 9% |
| — | ||
| CVE-2020-0688 | RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys CVE-2020-0688 is a remote code execution vulnerability in Microsoft Exchange Server caused by the validation key not being uniquely created at install time, leaving deployments with a predictable, shared key (CWE-287, improper authentication). A remote attacker who can reach an affected Exchange server and knows the common install-time key can supply maliciously crafted, cryptographically signed payloads that the server trusts, triggering code execution without needing per-server secrets. Successful exploitation gives the attacker code execution on the Exchange server, which can be used to access mail data, move laterally, and stage follow-on activity; CISA notes known use in ransomware campaigns. All organizations running the affected on-premises Microsoft Exchange Server are in scope per CISA's listing, though the affected version range is not specified in the source data. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2021-11-03 with known ransomware use, and EPSS rates 30-day exploitation probability at 100% (top percentile). Do: Apply Microsoft's Exchange security updates addressing CVE-2020-0688 (released in February 2020) to every on-premises Exchange server, per CISA's required action. As an interim mitigation, configure a unique ASP.NET machineKey in each Exchange server's web.config instead of the default shared install-time key, and hunt for indicators of exploitation given the known ransomware use. | 8.8 | 100% | KEV ransomware PoC ×2 |
| masshundreds of thousands of on-premises Exchange servers (≈500,000) | |
| CVE-2020-10189 | Unauthenticated RCE in Zoho ManageEngine Desktop Central Zoho ManageEngine Desktop Central contains a file upload vulnerability (CWE-502, deserialization of untrusted data) that can be exploited without authentication. A remote attacker sends crafted upload requests to the affected application, which accepts and processes the uploaded content without any credentials, resulting in execution of attacker-controlled code. Successful exploitation yields remote code execution on the server hosting Desktop Central, giving the attacker a foothold on an endpoint-management system that typically has broad reach into a corporate network. Any organization running the affected Zoho ManageEngine product is exposed, and exploitability does not depend on user interaction or credentials. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating known exploitation in the wild, and EPSS assigns a 99.9% probability of exploitation within 30 days; specific exploited versions are not stated in the available data. Do: Apply updates per Zoho/ManageEngine vendor instructions immediately, as the CISA KEV required action specifies. Restrict internet exposure of the Desktop Central server and audit it for signs of compromise (unexpected processes, webshells, outbound connections) since unauthenticated RCE has been exploited in the wild. Check that any exposed instances are patched before treating network access as safe. | 9.8 | 100% | KEV PoC ×3 |
| largetens of thousands of internet-exposed Desktop Central servers (order of magnitude 10k-100k) |
Full article644 words · extracted from helpnetsecurity.com · click to collapse
Most ransomware campaigns hitting healthcare organizations and critical services right now are just the final act of a months-long compromise.
“Using an attack pattern typical of human-operated ransomware campaigns, attackers have compromised target networks for several months beginning earlier this year and have been waiting to monetize their attacks by deploying ransomware when they would see the most financial gain,” says the Microsoft Threat Protection Intelligence Team.
Organizations who have yet to witness the final act (data exfiltration, file encryption) may have time to prevent it altogether and boot the attackers out before more damage is done.
Of course, those who have checked for organization-wide compromise and found nothing are the luckiest ones, but should nevertheless put up protections and mitigations as soon as possible.
Skilled attackers and a common attack pattern
“Human-operated ransomware attacks represent a different level of threat because adversaries are adept at systems administration and security misconfigurations and can therefore adapt to any path of least resistance they find in a compromised network,” the team explained.
“If they run into a wall, they try to break through. And if they can’t break through a wall, they’ve shown that they can skillfully find other ways to move forward with their attack. As a result, human-operated ransomware attacks are complex and wide-reaching. No two attacks are exactly the same.”
They might not be exactly the same, but they are variation on a common attack pattern – the attackers achieve initial access via vulnerable and unmonitored internet-facing systems, steal credentials, perform lateral movement, make sure to achieve persistence on the systems/networks and, finally, deploy the ransomware payload
Mitigation
For the initial step, attackers usually:
- Brute-force RDP endpoints or Virtual Desktop endpoints without multi-factor authentication (MFA)
- Exploit misconfigurations of web servers (e.g., IIS), backup servers, systems management servers, electronic health record (EHR) software, etc.
- Exploit vulnerabilities in older, no longer supported platforms (e.g., Windows Server 2003 and 2008)
- Exploit vulnerabilities in widespread solutions like the Citrix Application Delivery Controller (ADC) systems (e.g., CVE-2019-1978) and Pulse Secure VPN systems (CVE-2019-11510).
Microsoft thinks it likely that CVE-2019-0604 (affecting Microsoft SharePoint servers), CVE-2020-0688 (affecting Microsoft Exchange Server), and CVE-2020-10189 (affecting Zoho ManageEngine Desktop Central) will also be soon exploited by these attackers.
Of course, attackers are not adverse to simultaneously try to deliver the ransomware via phishing emails or downloader Trojans that may already present on enterprise systems.
While fixing those weak spots is imperative, it may already be too late, so enterprise administrators and cybersecurity teams must also search for indication that their systems and networks have been breached and, if they find them, to start remediation immediately.
Detection and remediation
The Microsoft Threat Protection Intelligence Team has shared possible indicators of compromise for human-operated ransomware campaigns, such as presence of malicious PowerShell scripts, penetration testing tools, suspicious access to Local Security Authority Subsystem Service (LSASS) or suspicious registry modifications, security event logs that have been tampered with, and more.
They’ve also provided advice on how to go about eradicating the attackers’ presence completely and mitigating the fallout.
“As ransomware operators continue to compromise new targets, defenders should proactively assess risk using all available tools. You should continue to enforce proven preventive solutions—credential hygiene, minimal privileges, and host firewalls—to stymie these attacks, which have been consistently observed taking advantage of security hygiene issues and over-privileged credentials,” they noted.
Keith McCammon, co-founder and CSO of threat detection and response specialist Red Canary, says that the fact that ransomware actors continue to successfully leverage some textbook breach tactics underscores the need not just for better preventative controls, but for robust detection coverage, careful investigation, and proactive hunting for threats that others controls have missed.
“Microsoft’s dedication to preventing and stopping these everyday ransomware attacks is refreshing in a world where many security vendors focus their attention primarily on splashy detection of nation-state actors,” he added.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2020/04/30/ransomware-campaigns/