Experts Expose Secrets of Conti Ransomware Group That Made 25 Million from Victims
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-13374 | Improper Access Control in Fortinet FortiOS and FortiADC Exposes LDAP Credentials Fortinet FortiOS (FortiGate) and FortiADC contain an improper access control flaw (CWE-732) related to the LDAP server connectivity test feature. An attacker can point an LDAP connectivity test request to a rogue LDAP server under their control, causing FortiGate to transmit its configured LDAP server login credentials to that server. Capturing these credentials yields valid LDAP bind credentials — typically Active Directory usernames and passwords — that can be reused for further access into the victim's directory environment. Organizations running affected FortiGate (FortiOS) or FortiADC appliances with LDAP authentication configured are exposed; the available data does not specify exact affected version ranges. The flaw is listed in CISA's KEV (added 2022-09-08) with known ransomware use, and EPSS assigns a 37.8% probability of exploitation within 30 days (98th percentile). Do: Apply updates per Fortinet's vendor instructions on both FortiOS and FortiADC, as required by the CISA KEV listing. After patching, rotate the LDAP bind credentials configured on FortiGate in case they were captured, and review logs for LDAP connectivity test requests directed at unexpected or unauthorized LDAP servers. | 4.3 | 38% | KEV ransomware |
| mass≈1M+ installations (FortiGate is among the most widely deployed firewall lines, with hundreds of thousands of Fortinet devices visible in public internet scans) | |
| CVE-2018-13379 | Unauthenticated Path Traversal in Fortinet FortiOS SSL VPN CVE-2018-13379 is a path traversal flaw (CWE-22) in the Fortinet FortiOS SSL VPN web portal that allows an unauthenticated attacker to download FortiOS system files via specially crafted HTTP resource requests. By traversing directories through crafted requests to the exposed web portal, the attacker can retrieve sensitive files, a technique publicly documented as yielding the SSL VPN session file containing usernames and passwords in plaintext. Any organization running the SSL VPN web portal on a FortiGate appliance is affected, and risk is highest where the portal is directly reachable from the internet. The flaw is confirmed in the wild: it was added to the CISA KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public PoC is listed in the provided data, but credential theft tied to this bug has been widely reused by threat actors. Do: Apply the patched FortiOS release per Fortinet's vendor advisory immediately, as this is a CISA KEV required action; if the fixed version is not known from this data, follow Fortinet's FG-IR-18-384 advisory for the correct upgrade path. Rotate SSL VPN credentials and review VPN access logs for path-traversal requests, since successful exploitation exposes plaintext session credentials, and restrict SSL VPN portal exposure to trusted sources where possible. | 9.8 | 100% | KEV ransomware |
| mass≈500,000 internet-exposed FortiOS SSL VPN portals (Fortinet cited ~480,000 affected devices) | |
| CVE-2021-1675 | Remote Code Execution in Microsoft Windows Print Spooler (PrintNightmare) CVE-2021-1675 is a code execution flaw in the Windows Print Spooler service affecting the listed Windows 10, 7, 8.1, RT 8.1 and Windows Server editions. It is triggered through print operations processed by the spooler, notably print driver handling; the public PoC demonstrates DLL injection into the spooler, allowing an attacker to run arbitrary code with the privileges of the spooler service, typically SYSTEM. Successful exploitation yields full system compromise: installing programs, viewing or deleting data, creating accounts, and lateral movement into domains, which is why it has been widely used as a ransomware entry vector. Any Windows system with the Print Spooler service enabled is exposed, and the service runs by default on servers, domain controllers, and most workstations. Exploitation is confirmed in the wild: a public PoC is available, the flaw was weaponized by the Magniber and Vice Society ransomware groups, it was added to CISA KEV on 2021-11-03 with known ransomware use, and Microsoft issued out-of-band fixes after it was being exploited in the wild. Do: Apply Microsoft's out-of-band security updates immediately on all affected Windows client and server systems (per CISA KEV required action), prioritizing domain controllers and print/file servers. As an interim mitigation, disable the Print Spooler service on hosts that do not need printing (e.g., domain controllers) and restrict RPC/network access to the spooler on systems that must keep it running. Check for compromise by looking for unexpected DLL or driver files loaded by the spooler, spoolsv.exe spawning unusual child processes, and ransomware indicators given documented Magniber and Vice Society abuse. | 7.8 | 86% | KEV ransomware PoC |
| masshundreds of millions of Windows endpoints and servers (Print Spooler runs by default across the 1B+ device Windows installed base) | |
| CVE-2021-34527 | PrintNightmare: Remote Code Execution in Microsoft Windows Print Spooler CVE-2021-34527, widely known as 'PrintNightmare', is a remote code execution flaw in the Microsoft Windows Print Spooler service, which improperly performs privileged file operations such as loading printer driver DLLs. An attacker with low-level access who can reach a machine's spooler, for example a domain user able to add a printer connection via Point and Print, can induce the SYSTEM-privileged service to load an attacker-controlled DLL with no user interaction required (CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N). Successful exploitation yields arbitrary code execution as SYSTEM, letting the attacker install programs, view, change or delete data, and create new accounts with full user rights, effectively achieving complete host compromise. The flaw affects all supported Windows client and server releases in the CISA data, Windows 10 from 1507 through 22H2, Windows 11, Windows RT 8.1, and Windows Server 2008, 2012 and 2016, wherever the Print Spooler service is running. Exploitation is confirmed in the wild: the bug was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, the FBI and CISA have warned of Russian actors exploiting it, and EPSS places the 30-day exploitation probability at 99.8%. Do: Install the July 2021 security updates immediately, released July 6, 2021 with additional updates on July 7 for Windows Server 2012, Windows Server 2016 and Windows 10 version 1607, and review KB5005010 for restricting installation of new printer drivers after applying the July 6 updates. Where patching is delayed, disable the Print Spooler service on hosts that do not need printing or restrict Point and Print, and verify that NoWarningNoElevationOnInstall and UpdatePromptSettings under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint are set to 0 or not defined (these keys do not exist by default, which is the secure state; NoWarningNoElevationOnInstall = 1 makes the system vulnerable by design). Prioritize domain controllers and servers with exposed spoolers, and hunt… | 8.8 | 100% | KEV ransomware PoC ×3 |
| masshundreds of millions of Windows systems (order of magnitude 10^8) | |
| CVE-2021-36958 | A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. NVD description · AI analysis pending | 7.8 | 31% |
| — |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | contirecovery.info | Cymru last month highlighted a similar open web URL named "contirecovery[.]info." "In order to tackle the complex challenge of disrupting |
| domain | contirecovery.ws | , revealing extensive details of a clearnet website called "contirecovery[.]ws" that contains instructions for purchasing decryption key |
| domain | xmpp.jp | g the roles of admin ("Tokyo"), assistant ("it_work_support@xmpp[.]jp"), and recruiter ("IT_Work") to attract new affiliates in |
Full article654 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananNov 19, 2021
The clearnet and dark web payment portals operated by the Conti ransomware group have gone down in what appears to be an attempt to shift to new infrastructure after details about the gang's inner workings and its members were made public.
According to MalwareHunterTeam, "while both the clearweb and Tor domains of the leak site of the Conti ransomware gang is online and working, both their clearweb and Tor domains for the payment site (which is obviously more important than the leak) is down."
It's not clear what prompted the shutdown, but the development comes as Swiss cybersecurity firm PRODAFT offered an unprecedented look into the group's ransomware-as-a-service (RaaS) model, wherein the developers sell or lease their ransomware technology to affiliates hired from darknet forums, who then carry out attacks on their behalf while also netting about 70% of each ransom payment extorted from the victims.
The result? Three members of the Conti team have been identified so far, each playing the roles of admin ("Tokyo"), assistant ("it_work_support@xmpp[.]jp"), and recruiter ("IT_Work") to attract new affiliates into their network.
While ransomware attacks work by encrypting the victims' sensitive information and rendering it inaccessible, threat actors have increasingly latched on to a two-pronged strategy called double extortion to demand a ransom payment for decrypting the data and threaten to publicly publish the stolen information if the payment is not received within a specific deadline.
"Conti customers – affiliate threat actors – use [a digital] management panel to create new ransomware samples, manage their victims, and collect data on their attacks," noted the researchers, detailing the syndicate's attack kill chain leveraging PrintNightmare (CVE-2021-1675, CVE-2021-34527, and CVE-2021-36958) and FortiGate (CVE-2018-13374 and CVE-2018-13379) vulnerabilities to compromise unpatched systems.
Emerging on the cybercrime landscape in October 2019, Conti is believed to be the work of a Russia-based threat group called Wizard Spider, which is also the operator of the infamous TrickBot banking malware. Since then, at least 567 different companies have had their business-critical data exposed on the victim shaming site, with the ransomware cartel receiving over 500 bitcoin ($25.5 million) in payments since July 2021.
What's more, an analysis of ransomware samples and the bitcoin wallet addresses utilized for receiving the payments has revealed a connection between Conti and Ryuk, with both families heavily banking on TrickBot, Emotet, and BazarLoader for actually delivering the file-encrypting payloads onto victim's networks via email phishing and other social engineering schemes.
PRODAFT said it was also able to gain access to the group's recovery service and an admin management panel hosted as a Tor hidden service on an Onion domain, revealing extensive details of a clearnet website called "contirecovery[.]ws" that contains instructions for purchasing decryption keys from the affiliates. Interestingly, an investigation into Conti's ransomware negotiation process published by Team Cymru last month highlighted a similar open web URL named "contirecovery[.]info."
"In order to tackle the complex challenge of disrupting cybercriminal organizations, public and private forces need to work collaboratively with one another to better understand and mitigate the wider legal and commercial impact of the threat," the researchers said.
Update: The Conti ransomware's payment portals are back up and running, more than 24 hours after they were first taken down in response to a report that identified the real IP address of one of its recovery (aka payment) servers — 217.12.204[.]135 — thereby effectively bolstering its security measures.
"Looks like Europeans have also decided to abandon their manners and go full-gansta simply trying to break our systems,"the gang said in a statement posted on their blog, effectively confirming PRODAFT's findings, but characterizing the details as "simply disinformation," and that "the reported 25kk which we 'made since July' is straight-up BS - we've made around 300kk at least."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/11/experts-expose-secrets-of-conti.html