Ransomware Surges Annually Despite Law Enforcement Takedowns
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-4577 | OS Command Injection in Windows PHP-CGI Allows Remote Code Execution CVE-2024-4577 is an OS command injection flaw (CWE-78) in Windows-based PHP when it runs in CGI mode, allowing arbitrary code execution on the server. It is triggered when attacker-supplied characters in HTTP requests are mishandled by Windows' character-encoding conversion as the OS invokes php-cgi, letting attackers inject command-line arguments to the PHP interpreter; this bypasses the decade-old fix for CVE-2012-1823. A successful attacker gains the ability to run arbitrary commands and code in the context of the web server. Affected systems are PHP running on Windows through the CGI interface; deployments that do not use PHP-CGI on Windows are not described as affected in the source data. Exploitation is active: the flaw was added to CISA KEV on 2024-06-12 with known ransomware use, and EPSS assigns roughly 100% probability of exploitation within 30 days. Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use: upgrade Windows PHP-CGI deployments to a PHP release that fixes CVE-2024-4577 per PHP Group advisories, or stop using CGI mode on Windows (e.g., switch to FastCGI) and apply any vendor-recommended workarounds. Given known ransomware abuse, review web server access logs for exploitation attempts (notably %AD-encoded soft hyphens and injected -d/-s arguments in php-cgi query strings) and prioritize patching internet-facing Windows hosts. | 9.8 | 100% | KEV ransomware PoC ×11 |
| large≈10,000–100,000 internet-exposed Windows PHP-CGI systems |
Full article437 words · extracted from infosecurity-magazine.com · click to collapse
The number of successful ransomware attacks advertised on leak sites increased 9% year-on-year (YoY) in the first quarter of 2024 despite high-profile law enforcement disruption of major groups, Symantec has claimed.
The security vendor said it recorded 962 claimed attacks in the first quarter of 2024 – down from the 1190 attacks of the previous three months, but still more than the 886 claimed in the first quarter of 2023.
Global law enforcers teamed up to make arrests, take down infrastructure and undermine the credibility of the prolific ALPHV/BlackCat and LockBit groups in December 2023 and February 2024 respectively.
However, although BlackCat subsequently disappeared, LockBit appears to be still operational.
“LockBit’s position as the number one ransomware threat remained unchallenged in the first quarter of 2024, accounting for over 20% of all claimed attacks,” said Symantec.
Read more on ransomware: Ransomware Attack Demands Reach a Staggering $5.2m in 2024.
In terms of claimed attacks on leak sites, the chasing pack include Qilin, Play, Phobos, Hunters and Bianlian – all of which are on a share of 7% of leak site posts.
However, Symantec’s own data from investigations it conducted in Q1 2024 places LockBit on 32%, followed by Akira (14%) and Blacksuit (11%).
“The comparison may give some indication of success rates experienced by actors linked to each operation,” Symantec said.
“For Symantec to positively identify an attack as associated with a certain ransomware family, the attack has to advance to the stage where the attackers attempt to deploy a payload. This suggests that attackers using Akira and Blacksuit are more likely to advance their attacks at least to the payload deployment stage.”
Vulnerability Exploits Continue to Reap Rewards
The report also claimed that exploitation of known vulnerabilities in public facing applications continues to be the main vector for ransomware attacks. Symantec cited recent attacks on web servers exploiting CVE-2024-4577; a CGI argument injection flaw affecting all versions of PHP installed on Windows.
However, not all cybersecurity vendors agree. Coveware’s latest report covering Q1 2024 claimed that remote access compromise remains the top method of initial access, followed some way behind by phishing and vulnerability exploitation, which are virtually tied.
Elsewhere, Symantec pointed to the continued use of “Bring-Your-Own-Vulnerable-Driver” (BYOVD) tactics to disable security solutions.
“Since drivers are signed and can obtain kernel access, they are frequently used to kill processes,” it explained.
“A correctly written driver will contain checks to ensure that only the software it’s designed to work with is issuing commands and that it’s only used for its intended purpose. A vulnerable driver, in the wrong hands, becomes a de facto privilege escalation tool.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/ransomware-surges-2024-law/