Hive malware operators attack Microsoft Exchange servers
Hive ransomware operators attack Microsoft Exchange servers that are vulnerable to the notorious ProxyShell problems.
On compromised machines, attackers deploy various backdoors, รวมทั้ง Cobalt Strike beacons, then conduct reconnaissance, steal credentials and valuable information, and only then proceed to encrypt files.
Varonis, who are investigating what is happening after a ransomware attack on one of their customers, warned about the issue.
Let me remind you that the vulnerabilities, which were collectively called ProxyShell, became known in the summer of 2021.
Let me remind you that we, ตัวอย่างเช่น, พูดคุยเกี่ยวกับ Hancitor มัลแวร์, which uses phishing emails, compromised credentials, or brute-forcing RDP to access vulnerable Windows machines and exploits vulnerabilities in Microsoft Exchange.
ก่อนหน้านี้, ProxyShell bugs have already been used by many attackers, including such well-known hack groups as Conti, BlackByte, Babuk, Cuba และ LockFile. น่าเสียดาย, ที่ Hive attacks show that not everyone has patched ProxyShell yet, and vulnerable servers can still be found on the network.
After exploiting ProxyShell bugs, Hive operators inject four web shells into an accessible Exchange directory and execute PowerShell code with high privileges, loading Cobalt Strike stagers. The researchers note that the web shells used in these attacks were taken from a public Git พื้นที่เก็บข้อมูล and then simply renamed to avoid detection.
On the attacked machines, the attackers also use the Mimikatz infostealer to steal the password from the domain administrator account and perform a lateral movement. In this way, hackers look for the most valuable data in order to force the victim to pay a ransom later.
