עקספּערץ באַווייַזן R4IoT ראַנסאָמוואַרע אַטאַק פון דער צוקונפֿט

Forescout TechnologiesVedere Labs has unveiled a new R4IoT ransomware attack: a PoC ransomware attack on IoT and OT equipment.

Let me remind you that we also said that New Version of Magniber Ransomware Threatens Windows 11 יוזערז, and also that The Appearance of Cheap DarkCrystal RAT Malware Worried Experts.

According to Daniel dos Santos, head of research at Vedere Labs, this is “the first and only work currently bridging the worlds of IT, OT, and IoT ransomware.”

Vedere Labs demonstrates R4IoT (“Ransomware for IoT” ): a proof of concept for next-generation ransomware that exploits IoT devices for initial access, targets IT devices to deploy ransomware and cryptominers, and leverages poor OT security practices to cause physical disruption to business operations.the company's specialists said.
Daniel dos Santos
Daniel dos Santos

The scheme of the attack is the following: using an IP camera, a hypothetical hacker hacks into the IT infrastructure of an organization and uses the access obtained to disable the operational-technological (OT) equipment. The attack exploits existing known vulnerabilities and does not include new exploits.

During the attack, the attacker hacks network-connected surveillance cameras, in particular from Axis און Hikvision. These two vendors account for 77% of all IP cameras on corporate networks, according to Forescout. אין צוגאב, more than half a million devices use the factory configuration of VLAN 1, which means that the cameras are not properly configured for network segmentation.

The researchers showed how, using vulnerabilities in cameras, attackers can execute commands to gain access to Windows machines. From there, they can execute further commands to detect additional machines connected to the cameras and machines with weak credentials, open RDP ports, and establish SSH tunnels.

The attackers can then use this access to open an RDP session, install malware, and disable firewalls and antivirus solutions. Access allows hackers to elevate their privileges, install ransomware and cryptocurrency miners, and run malicious executables that target OT systems.

In their video, the experts demonstrated a simulation of a ransomware attack on a mock hospital. The researchers accessed the IP camera and, through it, the hospital’s network, and identified the programmable logic controller used to control the hospital’s HVAC system. After escalating their privileges, they installed ransomware and disabled HVAC.

Although the simulated attack is too specific to be directly applied to any one organization, Vedere Labsresearch shows how attackers can cause serious harm to organizations through various types of network-connected equipment.

העלגאַ סמיט

איך בין שטענדיק אינטערעסירט אין קאָמפּיוטער וויסנשאַפֿט, ספּעציעל דאַטן זיכערהייט און די טעמע, וואס הייסט היינט-צו-טאג "דאַטן וויסנשאַפֿט", זינט מיין פרי טינז. איידער איר קומען אין די ווירוס באַזייַטיקונג מאַנשאַפֿט ווי רעדאַקטאָר-אין-ראשי, איך געארבעט ווי אַ סייבערסעקוריטי מומחה אין עטלעכע קאָמפּאַניעס, אַרייַנגערעכנט איינער פון אַמאַזאָן ס קאָנטראַקטאָרס. אן אנדער דערפאַרונג: איך האָבן געלערנט אין Arden און רידינג אוניווערסיטעטן.

לאָזן אַ ענטפער

דער פּלאַץ ניצט Akismet צו רעדוצירן ספּאַם. לערנען ווי דיין באַמערקונג דאַטן זענען פּראַסעסט.

צוריק צו שפּיץ קנעפּל