During the pandemic crisis, cybercriminals are still looking for victims. Microsoft’s Threat Protection Intelligence Team has warned. The ransomware criminals are still looking to attack healthcare and critical service providers. It has also issued a detailed guide to reduce the risk of falling victim to them.
Previously, ransomware attacks were usually automated. But this time, Microsoft confirmed that these attacks are not done in an automated fashion. Instead, they are conducted by criminal gangs that work by compromising internet-facing network devices. They establish a presence on vulnerable systems months before they strike and steal and encrypt victims’ data.
The attackers have a range of vulnerabilities. They can use to access victims’ networks and work. Their way to capture credentials and prepare for the final ransomware activation, Microsoft noted.
The most recent ransomware attacks that were observed by the Microsoft security teams highlighted Remote Desktop Protocol or Virtual Desktop systems that aren’t secured with multi-factor authentication.
Older, unsupported and unpatched operating systems. For instance: Microsoft Windows Server 2003 with weak passwords and 2008, reconfigured web servers including Internet Information Services, backup servers, electronic health record software and systems management servers are all being attacked currently. Vulnerable Citrix Application Delivery Controller and Pulse Secure are also in ransomware criminals’ sights and should be patched as soon as possible.
Once the cybercriminals have access to the victims’ devices. They attempt to steal admin login credentials and move laterally within networks with common tools. For instance: Mimikatz and Cobalt Strike, Microsoft said.
After gaining access, the attackers usually create new accounts and modify Group Policy Objects in Windows. They add scheduled tasks and register operating system services, and deploy backdoors and remote access tools for persistence. They then wait for an opportune moment to activate the ransomware to blackmail victims.
Several human-operated ransomware payloads are actively being used presently.These include RobbinHood, REvil/Sodinokibi, the Java-based PonyFinal and Maze, the operators of which were among the first to sell stolen data from technology providers and public services it has attacked, Microsoft said.
One particular campaign, NetWalker, targets hospitals and healthcare providers through bogus COVID-19 subject emails with the ransomware delivered as a malicious Visual Basic script file.
Apart from actively patching systems, Microsoft said to watch out for malicious behaviours such as tampering with security event logs and other techniques used to evade detection, suspicious access to Local Security Authority Subsystem Service (LSASS), and Windows Registry database modifications which could indicate that credentials theft is taking place.
Investigating the Windows Event Log during the earliest part of a suspected breach. They are looking for event ID 4624 and logon type 2 or 10 could indicate post-compromise access, Microsoft said.
Later on, searching WEL for type 4 or 5 logons could also indicate suspected breach activity.
Ransomware criminals show no compunction as to the impact their attacks have on health care providers, Microsoft warned.
They have also recently caused extensive damage to organisations such as forex giant Travelex, which had to shut down its systems over the New Year, and global logistics company Toll Group.
If you’re concerned your personal details have been compromised, you can reach us at 1300 660 368 and one of our team members can help you stay safe from the ransomware attack.
