An ongoing threat campaign dubbed RE#TURGENCE has been observed, which involves targeting MS SQL servers in an attempt to deliver a MIMIC ransomware payload. Turkish threat actors with financial motivations seem to be aiming after the US, EU, and LATAM nations.
Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month.
Researchers used the xp cmdshell procedure to brute force access to the victim server and execute commands on the host.
This procedure should not be enabled; it is usually disabled by default.
The campaign's initial access phase is comparable to that of DB#JAMMER, which similarly used brute forcing administrative credentials to gain direct MSSQL access.
Following their successful execution of code via the xp cmdshell method, the attackers ran the command from the sqlservr.
This command helps to execute a PowerShell-encoded command, which is then decoded.
It was mostly focused on the DLL imports and the Cobalt Strike payload, which was made up of useless comment blocks and hundreds of lines of combined variables.
With Cobalt Strike serving as the primary point of code execution, the attackers opted for a more interactive strategy.
The attackers mounted and accessed a network share, from which they downloaded the AnyDesk binaries.
PsExec is a legitimate system administration tool that can execute programs on remote Windows hosts and is used for performing lateral movement.
When the Mimic ransomware is finally delivered, the attack chain comes to an end.
In January 2023, mimic was first discovered and became popular.
Mimic will remove all binaries that were utilized to facilitate the encryption procedure.
The encryption/payment notice that was saved on the victim's device was executed by the.
Exe process once the encryption operation was finished.
It is always best to avoid leaving important servers open to the internet.
Attackers were able to brute force their way into the server directly from outside the main network in the RE#TURGENCE scenario.
It is recommended that access to these resources should be made possible via a VPN or other even more secure infrastructure.
Try Kelltron's cost-effective penetration testing services for free to assess and evaluate the security posture of digital systems.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 10 Jan 2024 10:55:22 +0000