Attackers also Deploy a Cryptominer and Lockbit Ransomware

OXFORD, U.K.  — April 12, 2022 —

Sophos, a global leader in next-generation cybersecurity, today released findings on how attackers breached and spent five months inside a regional government server in the U.S., using it to browse online for a mix of hacker and IT administration tools that could help them carry out the attack. The attackers also installed a cryptominer before exfiltrating data and deploying Lockbit ransomware. The findings are detailed in a new article, “Attackers Linger on Government Agency Computers Before Deploying Lockbit Ransomware,” and suggest that multiple attackers infiltrated the vulnerable server. The attack was contained and investigated by Sophos’ incident response team.

“This was a very messy attack. Working together with the target, Sophos researchers were able to build a picture that started with what appears to be novice attackers breaking into the server, poking around the network and using the compromised server to Google a combination of pirated and free versions of hacker and legitimate admin tools to use in their attack. They then seemed unsure of what to do next,” said Andrew Brandt, principal security researcher at Sophos. “About four months after the initial breach, the nature of the attack activity changed, in some cases so drastically that it suggests attackers with very different skills had joined the fray. These attackers went on to attempt to uninstall security software. They eventually stole data and encrypted files on several machines by deploying Lockbit ransomware.”

The Sequence of Attack

Sophos researchers found that the initial point of access for the attack was an open remote desktop protocol (RDP) port on a firewall that was configured to provide public access to a server. The attackers breached the server in September 2021. They then used a browser on the breached server to search online for the tools to use for hacking and attempted to install them. In some cases, the search for tools led the attackers to shady download sites that delivered adware to the hacked server, instead of the tools they were looking for.

The research shows that attackers’ behaviors changed significantly in mid-January, with signs of more skilled and focused activity. These attackers attempted to remove the malicious cryptominer and uninstall security software, taking advantage of the fact that the target had inadvertently left a protective feature disabled after completing maintenance. The attackers then collected and exfiltrated data and deployed the Lockbit ransomware. The ransomware attack had limited success and the attackers failed to encrypt data on some machines.

Staying Protected

The tools the attackers tried to install for malicious purposes included Advanced Port Scanner, FileZilla, LaZagne, mimikatz, NLBrute, Process Hacker, PuTTY, Remote Desktop Passview, RDP Brute Forcer, SniffPass, and WinSCP. The attackers also installed commercial remote access tools, including ScreenConnect and AnyDesk.

“If a member of the IT team hasn’t downloaded them for a specific purpose, the presence of such tools on machines on your network is a red flag for an ongoing or imminent attack,” said Brandt. “Unexpected or unusual network activity, such as a machine scanning the network is another such indicator. Repeated RDP login failures on a machine only accessible inside the network is a sign someone might be using a brute-force tool to try to move laterally. As are active connections from commercial remote access tools the IT team has not installed or may have used in the past but have not used for a while.

“A robust, proactive, 24/7 defense-in-depth approach will help to prevent such an attack from taking hold and unfolding. The most important first step is to try to prevent attackers from gaining access to a network in the first place, for example by implementing multi-factor authentication and setting firewall rules to block remote access to RDP ports in the absence of a VPN connection.”

For further information read the article, “Attackers Linger on Government Agency Computers Before Deploying Lockbit Ransomware” on Sophos News.

Über Sophos

Sophos ist ein weltweit führender Anbieter von modernsten Sicherheitslösungen zur Abwehr von Cyberangriffen, einschließlich Managed Detection and Response (MDR) und Incident Response Services sowie einem breiten Portfolio an Endpoint-, Netzwerk-, E-Mail- und Cloud-Security-Technologien. Als einer der größten ausschließlich auf Cybersicherheit spezialisierten Anbieter schützt Sophos weltweit mehr als 600.000 Unternehmen und Organisationen und mehr als 100 Mio. Benutzer vor aktiven Angreifern, Ransomware, Phishing, Malware und mehr. Die Services und Produkte von Sophos sind über die Management-Konsole Sophos Central miteinander verbunden und werden vom bereichsübergreifenden Threat-Intelligence-Expertenteam Sophos X-Ops unterstützt. Die Sophos X-Ops Intelligence optimiert das gesamte Sophos Adaptive Cybersecurity Ecosystem. Dieses Ökosystem umfasst einen zentralen Data Lake, der eine Vielzahl offener APIs nutzt, die Kunden, Partnern, Entwicklern und anderen Cybersecurity- und Informationstechnologie-Anbietern zur Verfügung stehen. Sophos bietet Cybersecurity-as-a-Service für Unternehmen und Organisationen an, die vollständig verwaltete Sicherheitslösungen benötigen. Kunden können ihre Cybersicherheit auch direkt mit der Sophos Security-Operations-Plattform verwalten oder einen hybriden Ansatz nutzen, bei dem sie ihre internen Teams mit Sophos-Services ergänzen, einschließlich Threat Hunting und Maßnahmen zur Beseitigung von Bedrohungen. Sophos vertreibt seine Produkte und Services über ein weltweites Netzwerk von Vertriebspartnern und Managed Service Providern (MSPs). Sophos hat seinen Hauptsitz im britischen Oxford. Weitere Informationen finden Sie unter www.sophos.de.