Ransomware Groups Prioritize Defense Evasion for Data Exfiltration
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-13379 | Unauthenticated Path Traversal in Fortinet FortiOS SSL VPN CVE-2018-13379 is a path traversal flaw (CWE-22) in the Fortinet FortiOS SSL VPN web portal that allows an unauthenticated attacker to download FortiOS system files via specially crafted HTTP resource requests. By traversing directories through crafted requests to the exposed web portal, the attacker can retrieve sensitive files, a technique publicly documented as yielding the SSL VPN session file containing usernames and passwords in plaintext. Any organization running the SSL VPN web portal on a FortiGate appliance is affected, and risk is highest where the portal is directly reachable from the internet. The flaw is confirmed in the wild: it was added to the CISA KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public PoC is listed in the provided data, but credential theft tied to this bug has been widely reused by threat actors. Do: Apply the patched FortiOS release per Fortinet's vendor advisory immediately, as this is a CISA KEV required action; if the fixed version is not known from this data, follow Fortinet's FG-IR-18-384 advisory for the correct upgrade path. Rotate SSL VPN credentials and review VPN access logs for path-traversal requests, since successful exploitation exposes plaintext session credentials, and restrict SSL VPN portal exposure to trusted sources where possible. | 9.8 | 100% | KEV ransomware |
| mass≈500,000 internet-exposed FortiOS SSL VPN portals (Fortinet cited ~480,000 affected devices) | |
| CVE-2020-1472 | Unauthenticated Privilege Escalation (Zerologon) in Microsoft Netlogon Domain Controllers CVE-2020-1472, widely known as "Zerologon," is an elevation-of-privilege flaw in how the Netlogon secure channel is established over the Netlogon Remote Protocol (MS-NRPC) on Microsoft domain controllers. An unauthenticated attacker with network reachability to a domain controller sends specially crafted Netlogon messages to establish a vulnerable secure channel and then runs a specially crafted application on the network to obtain domain administrator access. Successful exploitation yields domain administrator privileges, effectively full compromise of the Active Directory environment, and the flaw is known to be used in ransomware operations. Any organization running affected Windows Server versions (2008 through 20H2) as domain controllers is exposed, along with environments using Netlogon implementations from Samba and distributions or products from Fedora, openSUSE, Canonical (Ubuntu), Debian, Synology, and Oracle. Exploitation is highly active: a public Zerologon PoC/exploit is available, the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, with known ransomware use), and EPSS estimates a 99.4% probability of exploitation within 30 days. Do: Apply the vendor updates on all domain controllers and other affected systems immediately, following Microsoft's two-phase Netlogon secure channel guidance (the enforcement phase of the phased rollout began in Q1 2021). Audit Netlogon secure-channel connections and event logs for clients still using vulnerable connections before enabling full enforcement, and install updated packages for Samba and other Netlogon implementations from Fedora, openSUSE, Ubuntu, Debian, Synology, and Oracle. Given known ransomware use, prioritize patching any domain controller reachable from user networks, VPNs, or the internet. | 5.5 | 99% | KEV ransomware PoC |
| massmillions of domain controllers worldwide (essentially every Active Directory domain), with hundreds of thousands of domain controllers/RPC endpoints… | |
| CVE-2023-0669 | Pre-Authentication Deserialization RCE in Fortra GoAnywhere MFT Fortra (formerly HelpSystems) GoAnywhere MFT is vulnerable to pre-authentication remote code execution (CWE-502) in the License Response Servlet, which deserializes an attacker-controlled object without validating it. An unauthenticated attacker who can reach the exposed administrative interface can send a crafted serialized object to the servlet and trigger code execution on the server. Successful exploitation gives the attacker the ability to run arbitrary code in the context of the application, which has been leveraged for ransomware operations. All organizations running GoAnywhere MFT with the affected component reachable by untrusted networks are in scope. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-02-10, ransomware use is confirmed, and EPSS puts the 30-day exploitation probability at 100%. Do: Apply the vendor's updates for GoAnywhere MFT immediately, per Fortra's instructions, as required by the CISA KEV catalog. Until patched, restrict or block untrusted/internet access to the administrative interface hosting the License Response Servlet, and review logs for signs of exploitation given confirmed in-the-wild and ransomware use. | 7.2 | 100% | KEV ransomware PoC ×3 |
| moderate≈1,000–10,000 internet-exposed GoAnywhere MFT instances (public internet scans of the exposed administrative interface) |
Full article870 words · extracted from infosecurity-magazine.com · click to collapse
Ransomware attackers are applying a significant focus on defense evasion tactics to increase dwell time in victim networks, according to a new report by Cisco Talos.
This trend is a result of the shift to the double-extortion ransomware model, in which attackers aim to steal sensitive data and threaten to publish it online alongside locking down the victims’ systems.
Ransomware threat actors need to gain persistent access to understand the network’s structure, locate resources that can support the attack, and identify data of value that can be stolen, the researchers said.
The Cisco Talos report analyzed the tactics, techniques and procedures (TTPs) of the 14 most active ransomware groups between 2023 and 2024.
During Infosecurity Europe 2024, experts highlighted how data exfiltration is now the main way ransomware groups extort victims.
Hackers now view encryption as an add on or don’t bother locking down data at all.
How Attackers Are Establishing Persistence
The Cisco report highlighted a range of techniques deployed by ransomware actors to evade detection and move laterally in a network following initial access.
The most prominent groups quickly focus on defense evasion techniques, including:
- The disablement and modification of security software such as anti-virus programs, endpoint detection solutions or security features in the operating system to prevent the detection of the ransomware payload
- Obfuscate malicious software by packing and compressing the code, eventually unpacking itself in memory when executed
- Modify the system registry to disable security alerts
- Configure the software to execute at startup
- Block certain recovery options for users
Living-off-the-Land Techniques
Attackers will then look to establish long-term access, ensuring their operations are successful even if their initial intrusion is discovered and remediated.
These persistence techniques include the use of automated malware persistence mechanisms, such as AutoStart execution upon system boot and creation of remote access software tools.
After achieving persistent access, threat actors will attempt to move laterally in the network and locate and exfiltrate sensitive data prior to deploying the ransomware payload.
They often look to exploit weak access controls and elevate privileges to the administrator level to progress further along the attack chain using various local utilities and legitimate services.
These ‘living-off-the-land’ techniques are designed to blend in with typical operating system functions. They often involve the use of network scanner utilities in conjunction with local operating system tools and utilities, such as Certutil, Wevtutil, Net, Nltes and Netsh.
Data Exfiltration and Encryption
After locating sensitive files in the network, attackers have developed effective methods for concealing the exfiltration of this data.
The researchers identified the regular use of compression and encryption utilities such as WinRAR and 7-Zip to conceal the exfiltration and transfer of sensitive files to an external adversary-controlled resource or over a command and control (C2) mechanism.
For more mature operations, some ransomware-as-a-service (RaaS) groups have developed custom data exfiltration tools to facilitate data theft, such as StealBit, which is used by LockBit.
Following data exfiltration, the attackers can stage the ransomware payload and encrypt the network before informing the victims and starting negotiations.
If the goal is pure data theft extortion, then the encryption phase is skipped.
Growing Vulnerability Exploitation
Ransomware attackers are increasingly exploiting known and zero-day vulnerabilities in public-facing applications for initial access, the researchers found.
The exploitation of these and other critical vulnerabilities can also enable privilege escalation, providing a basis for evading detection and establishing persistent access.
Read here: Chinese State Actor APT40 Exploits N-Day Vulnerabilities “Within Hours”
Cisco highlighted three vulnerabilities that have been repeatedly exploited by prominent ransomware groups in the past year:
- CVE-2020-1472: Also known as ‘Zerologon’, this flaw is in the Netlogon Remote Protocol. Attackers can bypass authentication mechanisms and change computer passwords within a domain controller's Active Directory, allowing them to quickly escalate privileges to domain administrator levels
- CVE-2018-13379: The vulnerability in Fortinet's FortiOS SSL VPN allows unauthenticated attackers to access system files through specially crafted HTTP requests. This enables threat actors to gain sensitive information, such as VPN tokens, and advance through the attack chain moving laterally within the network
- CVE-2023-0669: This GoAnywhere Managed File Transfer flaw allows remote attackers to execute arbitrary code on the server without requiring authentication. The compromised server can be used as a pivot for further internal reconnaissance and lateral movement
Defending Against Evolving Ransomware Tactics
Cisco highlighted key steps organizations should take to mitigate the TTPs employed by ransomware groups. These are:
- Apply patches and updates regularly to all systems and software
- Implement strong password policies and enforce multi-factor authentication (MFA) for each account
- Minimize attack surfaces by disabling unnecessary services and features, and apply best practices to harden all systems and environments
- Segment networks using VLANs or similar technologies to isolate sensitive data and systems, thereby preventing lateral movement
- Implement a Security Information and Event Management (SIEM) system to continuously monitor and analyze security events
- Adopt a least-privilege approach, ensuring that users and systems have only the minimal level of access necessary to perform their functions
- Minimize your IT systems’ exposure to the internet y limiting the number of public-facing services and ensuring robust protections for any necessary external interfaces
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/ransomware-defense-evasion-data/