OldGremlin Ransomware Targeted Over a Dozen Russian Entities in Multi
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-3153 | DLL Search Path Hijacking LPE in Cisco AnyConnect Secure Mobility Client for Windows CVE-2020-3153 is an uncontrolled search path vulnerability (CWE-427) in the Windows client of Cisco AnyConnect Secure Mobility Client, which mishandles directory paths when running with elevated privileges. An attacker or malware that already has valid credentials and local access on a Windows endpoint can copy malicious files, such as DLLs, into locations loaded by the elevated AnyConnect process. Successful exploitation yields system-level (SYSTEM) privilege execution on the endpoint via DLL preloading or DLL hijacking, making it an effective local privilege escalation step in broader intrusion chains. Any organization running the AnyConnect VPN client on Windows endpoints is potentially affected. The flaw was added to CISA KEV on 2022-10-24 with known ransomware use, and its EPSS of 28.3% (98th percentile) indicates an elevated probability of near-term exploitation, though no public PoC is known. Do: Apply the fixed AnyConnect release per Cisco's instructions, as required by CISA's KEV listing, prioritizing Windows endpoints where the client is installed. Inventory your estate for AnyConnect installations and verify client builds are current. Given the known ransomware use, hunt for signs of local DLL planting in writable directories and review privilege-escalation activity on Windows hosts. | 6.5 | 28% | KEV ransomware PoC ×4 |
| massmillions of enterprise Windows endpoints (AnyConnect is among the most widely deployed corporate VPN clients) | |
| CVE-2020-3433 | DLL Hijacking LPE in Cisco AnyConnect Secure Mobility Client for Windows Cisco AnyConnect Secure Mobility Client for Windows contains a DLL hijacking flaw (CWE-427) in its interprocess communication (IPC) channel, caused by insufficient validation of resources loaded at run time. An attacker who already has valid credentials on the Windows machine can send a crafted IPC message to the AnyConnect process and coerce it into loading a malicious DLL. Successful exploitation allows arbitrary code execution with SYSTEM privileges, turning a low-privileged local foothold into full administrative control of the endpoint. Any organization running AnyConnect on Windows endpoints is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-10-24 with known ransomware use, a public proof-of-concept is available, and news reports confirm active exploitation alongside another AnyConnect Windows flaw. Do: Upgrade Cisco AnyConnect for Windows to a fixed release per Cisco's security advisory, as required by the CISA KEV required action (apply updates per vendor instructions). Since exploitation requires valid local credentials, limit local logon privileges on endpoints and prioritize patching given known ransomware use. Inventory Windows endpoints for AnyConnect installs and monitor for suspicious DLL loads in the AnyConnect process path. | 7.8 | 10% | KEV ransomware PoC |
| masstens of millions of Windows endpoints running AnyConnect (dominant enterprise VPN client installed base; no precise public count in this data) |
Full article859 words · extracted from thehackernews.com · click to collapse
A Russian-speaking ransomware group dubbed OldGremlin has been attributed to 16 malicious campaigns aimed at entities operating in the transcontinental Eurasian nation over the course of two and a half years.
"The group's victims include companies in sectors such as logistics, industry, insurance, retail, real estate, software development, and banking," Group-IB said in an exhaustive report shared with The Hacker News. "In 2020, the group even targeted an arms manufacturer."
In what's a rarity in the ransomware landscape, OldGremlin (aka TinyScouts) is one of the very few financially motivated cybercrime gangs that primarily focuses on Russian companies.
Other notable groups consist of Dharma, Crylock, and Thanos, contributing to an uptick in ransomware attacks targeting businesses in the country by over 200% in 2021.
OldGremlin first came to light in September 2020 when the Singapore-headquartered cybersecurity company disclosed nine campaigns orchestrated by the actor between May and August. The first attack was detected in early April 2020.
In all, the group is said to have conducted 10 phishing email campaigns in 2020, followed by one highly successful attack in 2021 and five more in 2022, with ransom demands touching a record $16.9 million and allowing the actor to net as much as $30 million in illicit revenues.
"OldGremlin thoroughly studies their victims," Group-IB explained. "The demanded ransom is therefore often proportional to the company's size and revenue and is obviously higher than the budget necessary for ensuring a suitable level of information security."
Known to mainly target enterprise networks running on Windows, attacks mounted by OldGremlin have leveraged phishing emails masquerading as tax and legal services companies to dupe victims into clicking on fraudulent links and downloading malicious files, allowing the attackers to worm their way inside the networks.
"The threat actors often pose as well-known companies, including the media group RBC, the legal assistance system Consultant Plus, the company 1C-Bitrix, the Russian Union of Industrialists and Entrepreneurs, and Minsk Tractor Works," Group-IB said.
Upon gaining an initial foothold, OldGremlin moves to establish persistence by creating scheduled tasks, gaining elevated privileges using Cobalt Stroke, and even flaws in Cisco AnyConnect (CVE-2020-3153 and CVE-2020-3433), while also gaining remote access to the compromised infrastructure using tools such as TeamViewer.
"Around 30% of attacks allowed OldGremlin to gain initial access and start post-exploitation," Oleg Skulkin, head of digital forensics and incident response team at Group-IB, told The Hacker News. "In roughly 10%, the threat actor was able to deploy ransomware enterprise-wide."
Some of the aspects that make the crew stand out from other ransomware groups is that it doesn't rely on double extortion to coerce targeted companies into paying up despite exfiltrating the data. It has also been observed taking long breaks after each successful attack.
What's more, the average dwell time until ransomware deployment has been pegged at 49 days, well above the reported 11 day median dwell time, suggesting extended efforts on part of the actor to examine the breached domain (which is achieved using a tool called TinyScout).
OldGremlin's most recent phishing wave occurred on August 23, 2022, with emails embedding links pointing to a ZIP archive payload hosted on Dropbox to activate the killchain.
These archive files, in turn, harbor a rogue LNK file (dubbed TinyLink) that downloads a backdoor called TinyFluff, which is one among the four implants used by the group: TinyPosh, TinyNode, and TinyShell, before deleting data backups and dropping the .NET-based TinyCrypt ransomware.
- TinyPosh: A PowerShell trojan engineered to collect and transfer sensitive information about the infected system to a remote server, and launch additional PowerShell scripts.
- TinyNode: A backdoor that runs the Node.js interpreter to execute commands received from a command-and-control (C2) server over the Tor network.
- TinyFluff: A successor to TinyNode, which is used as the primary downloader for receiving and running malicious scripts.
Also put to use by OldGremlin are other tools such as TinyShot, a console utility for capturing screenshots, TinyKiller, which kills antivirus processes via a bring your own vulnerable driver (BYOVD) attack targeting gdrv.sys and RTCore64.sys drivers.
It's worth noting that the operators behind the BlackByte ransomware group were also recently found leveraging the same flaw in the RTCore64.sys driver to turn off security solutions in the hacked machines.
One other unusual application used by OldGremlin in its attacks is a .NET console app called TinyIsolator, which temporarily cuts off the host from the network by disabling network adaptors prior to executing the ransomware.
On top of that, the group's malware arsenal encompasses a Linux version of TinyCrypt, which is written in the Go programming language and launched after deleting .bash_history files, changing user passwords to limit access to the compromised host, and disabling SSH.
"OldGremlin has debunked the myth that ransomware groups are indifferent to Russian companies," Ivan Pisarev, head of dynamic malware analysis team at Group-IB, said.
"Despite the fact that OldGremlin has been focusing on Russia so far, they should not be underestimated elsewhere. Many Russian-speaking gangs started off by targeting companies in post-Soviet space and then switched to other geographies."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/10/oldgremlin-ransomware-targeted-over.html