Hive malware operators attack Microsoft Exchange servers

Hive ransomware operators attack Microsoft Exchange servers that are vulnerable to the notorious ProxyShell problems.

On compromised machines, attackers deploy various backdoors, lakip Cobalt Strike beacons, then conduct reconnaissance, steal credentials and valuable information, and only then proceed to encrypt files.

Varonis, who are investigating what is happening after a ransomware attack on one of their customers, warned about the issue.

Let me remind you that the vulnerabilities, which were collectively called ProxyShell, became known in the summer of 2021.

ProxyShell combines three vulnerabilities that allow remote code execution without authentication on Microsoft Exchange servers. These vulnerabilities exploit the Microsoft Exchange Client Access Service (CAS) running on port 443.

Let me remind you that we, pananglitan, talked about Hancitor malware, which uses phishing emails, compromised credentials, or brute-forcing RDP to access vulnerable Windows machines and exploits vulnerabilities in Microsoft Exchange.

Previously, ProxyShell bugs have already been used by many attackers, including such well-known hack groups as Conti, BlackByte, Babuk, Cuba ug LockFile. Ikasubo, the Hive attacks show that not everyone has patched ProxyShell yet, and vulnerable servers can still be found on the network.

After exploiting ProxyShell bugs, Hive operators inject four web shells into an accessible Exchange directory and execute PowerShell code with high privileges, loading Cobalt Strike stagers. The researchers note that the web shells used in these attacks were taken from a public Git repository and then simply renamed to avoid detection.

On the attacked machines, the attackers also use the Mimikatz infostealer to steal the password from the domain administrator account and perform a lateral movement. In this way, hackers look for the most valuable data in order to force the victim to pay a ransom later.

Dugang pa, we were able to detect remnants of remote network scanners, lists of IP addresses, devices and directories, RDP for backup servers, SQL database scans and much more.Varonis analysts write.
Only after all valuable files have been successfully stolen, the ransomware payload (named Windows.exe) is deployed. Just before encrypting files, a Golang payload also removes shadow copies, disables Windows Defender, clears Windows event logs, kills file linking processes, and stops the Security Accounts Manager to disable alerts.

Helga Smith

Kanunay kong interesado sa siyensya sa kompyuter, ilabi na ang seguridad sa datos ug ang tema, nga gitawag karon "siyensya sa datos", sukad pa sa akong pagkabatan-on. Sa wala pa mosulod sa Virus Removal team isip Editor-in-chief, Nagtrabaho ko isip eksperto sa cybersecurity sa daghang kompanya, lakip ang usa sa mga kontraktor sa Amazon. Laing kasinatian: Naa koy pagtudlo sa mga unibersidad sa Arden ug Reading.

Pagbilin ug Tubag

Kini nga site naggamit sa Akismet aron makunhuran ang spam. Hibal-i kung giunsa ang pagproseso sa data sa imong komento.

Balik sa ibabaw nga buton