Tag: servers | Page 5

Microsoft SQL servers hijacked to deliver Cobalt Strike and ransomware

September 4, 2023/in Internet Security

Unknown threat actors are targeting poorly protected Microsoft SQL servers, in an attempt to infect them with a new strain of ransomware.

A new report from cybersecurity researchers Securonix outlines a campaign in which hackers first try to brute-force their way into MS SQL servers.

When they succeed, they do a number of things, including the deployment of a Cobalt Strike beacon, lateral movement across the target network and endpoints, and ultimately – the deployment of a ransomware strain called FreeWorld.

FreeWorld ransomware

FreeWorld seems to be a variant of a known encryptor called Mimic. While the goal of the campaign is as expected (stealing sensitive data and encrypting the endpoints) the way the hackers use the tools and infrastructure to get there is quite unique. Securonix explained in its writeup, saying: “Some of these tools include enumeration software, RAT payloads, exploitation and credential-stealing software, and finally ransomware payloads.”

The success of the campaign depends exclusively on the strength of the password used to protect an MS SQL server, the researchers concluded. “It’s important to emphasize the importance of strong passwords, especially on publicly exposed services.” After all, it’s the servers with weak passwords that ended up being compromised.

Ransomware is one of the most popular types of cybercrime out there. After a relatively peaceful 2022, this year the number of ransomware attacks skyrocketed, figures from Coveware have shown. At the same time, awareness among potential victims is growing, resulting in fewer organizations paying the ransom demand. The percentage of compromised organizations that ended up paying the ransom demand fell to a record low of 34%, the same source claims.

Those that did pay – ended up paying quite a lot. The average amount surpassed $700,000, up 126% compared to Q1 2023.

Via: TheHackerNews

Source…

Russian APT Group Caught Hacking Roundcube Email Servers

June 21, 2023/in Computer Security

A prolific APT group linked to the Russian government has been caught exploiting security flaws in the open-source Roundcube webmail software to spy on organizations in Ukraine, including government institutions and military entities involved in aircraft infrastructure.

According to an advisory [PDF] from threat intelligence firm Recorded Future, the Roundcube server infections are being used to run reconnaissance and exfiltration scripts, redirecting incoming emails and gathering session cookies, user information, and address books.

Recorded Future teamed up with Ukraine’s Computer Emergency Response Team (CERT-UA) to document the activity, which is being attributed to Russia’s GRU military spy unit.

“The campaign leveraged news about Russia’s war against Ukraine to encourage recipients to open emails with attachments, which immediately compromised vulnerable Roundcube servers without engaging with the attachment,” Recorded Future explained.

The company said the attachment contained JavaScript code that executed additional JavaScript payloads from the hacking team’s infrastructure. “The campaign displayed a high level of preparedness, quickly weaponizing news content into lures to exploit recipients. The spear-phishing emails contained news themes related to Ukraine, with subject lines and content mirroring legitimate media sources,” Recorded Future said.

The GRU-linked group, which has been operational since at least November 2021, has been blamed for previous use of zero-day flaws in Microsoft’s flagship Outlook software. According to public documentation, the group is focused on digital spying on entities in Ukraine and across Europe, primarily among government and military/defense organizations.

Recorded Future released IOCs and technical artifacts from the latest discovery to help defenders and recommended that organizations configure intrusion detection systems (IDS), intrusion prevention systems (IPS) or network defense mechanisms to pinpoint malicious activity from malicious domains.

Advertisement. Scroll to continue reading.

The company is also recommending that organizations implement measures to disable HTML and/or JavaScript within email…

Source…

New Tsunami botnet targets Linux SSH servers

June 20, 2023/in Computer Security

Researchers warn of an ongoing Tsunami DDoS botnet campaign targeting inadequately protected Linux SSH servers.

Researchers from AhnLab Security Emergency response Center (ASEC) have uncovered an ongoing hacking campaign, aimed at poorly protected Linux SSH servers, to install the Tsunami DDoS botnet (aka Kaiten). The threat actors behind these attacks were also observed installing other malware families, including ShellBot, XMRig CoinMiner, and Log Cleaner.

The Tsunami DDoS botnet operates as an IRC bot and relies on IRC for C2 communication.

The researchers pointed out that the source code of the Tsunami bot is publicly available allowing multiple threat actors to create their own botnet. The bot primarily targets IoT devices along with Linux servers with brute force attacks.

The following table contains the list ID and password values used by the bot in the dictionary attacks along with the IP address for the target.

ID	Password	Attack Target
admin	qwe123Q#	124.160.40[.]48
sxit	sxit	124.160.40[.]94
root	abcdefghi	124.160.40[.]94
root	123@abc	124.160.40[.]94
weblogic	123	124.160.40[.]94
rpcuser	rpcuser	124.160.40[.]94
test	p@ssw0rd	124.160.40[.]94
nologin	nologin	124.160.40[.]94
Hadoop	p@ssw0rd	124.160.40[.]94
hxw	test123	124.160.40[.]94
backlog	backlog	124.160.40[.]94
dell	123	124.160.40[.]94

Upon successfully logging in, the attackers execute a command to download and run various malware.

The downloader-type Bash script is used to install additional malware and perform various preliminary tasks to take control of infected systems, including the creation of a backdoor SSH account.

Threat actors also generated a new pair of public/private SSH keys for the compromised server to achieve persistent access, even if the user password was changed.

The variant of the Tsunami bot employed in this campaign is a Kaiten variant known as Ziggy, it maintains persistence by writing itself on the “/etc/rc.local” file.

In order to avoid detection, the bot attempts to change the name of the process that is currently running to “[kworker/0:0]”. Using this threat the malware uses normal process names, making it difficult for users to notice.

The Tsunami botnet supports multiple DDoS attack…

Source…