A sophisticated ransomware attack targeted Managed Service Providers (MSPs) through well-crafted phishing emails designed to appear as authentication alerts for their ScreenConnect Remote Monitoring and Management (RMM) tool. Prior to ransomware deployment, the attackers methodically targeted backup solutions and modified boot options to ensure systems would restart in Safe Mode with networking, effectively bypassing security controls. A key element of the attack was the download of “veeam.exe,” designed to exploit CVE-2023-27532, a vulnerability in the Veeam Cloud Backup service that allows unauthorized access to unencrypted credentials. When victims clicked the “Login and review the security alert” link, they were directed to a malicious domain (cloud.screenconnect[.]com.ms) that perfectly mimicked the legitimate ScreenConnect login page. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This attack resulted in the deployment of Qilin ransomware across multiple customer environments, showcasing the continued vulnerability of MSPs as supply chain targets. The threat actors leveraged domains specifically designed to spoof legitimate ScreenConnect URLs, with at least 25 malicious domains identified dating back to November 2022. This adversary-in-the-middle technique allowed the attackers to establish an authenticated session within the legitimate ScreenConnect environment, granting them super administrator privileges. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The attack began with a highly convincing phishing email alerting administrators to an alleged unauthorized login to their ScreenConnect instance. Upon gaining access to the administrator’s credentials, the attackers bypassed multi-factor authentication by intercepting the time-based one-time password (TOTP) sent to the administrator. The Qilin ransomware was then deployed with unique 32-character passwords for each customer environment, demonstrating the attackers’ awareness that they were targeting multiple distinct organizations through the compromised MSP. The attackers then utilized this backdoor to perform network enumeration, reset credentials, and deploy a variety of tools for lateral movement, including PsExec, NetExec, and WinRM. The attackers also employed WinRAR for data compression before exfiltrating sensitive information to easyupload.io using Google Chrome’s Incognito mode to hide forensic evidence. Sophos researchers identified this campaign as the work of a ransomware affiliate tracked as STAC4365, which has been conducting similar operations since late 2022. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 03 Apr 2025 15:10:20 +0000