A European biomolecular research institute involved in COVID-19 research lost a week’s worth of research data, all thanks to a Ryuk ransomware attack traced back to a student trying to save money by buying unlicensed software.
Security researchers at Sophos described the attack in a report published on Thursday, after the security firm’s Rapid Response team was called in to mop up the mess.
Hey, everybody makes mistakes, the researchers said. That frugal student made a few of them. But the student’s goof-ups advanced to a full-fledged ransomware attack because there weren’t security measures in place to stop those missteps from happening, the researchers said.
Remote-Access Slipups
As so many organizations do, the institute allows outsiders to access its network via their personal computers. They can do so by using remote Citrix sessions that don’t require two-factor authentication (2FA).
The lack of required 2FA should raise red flags right there, never mind the fact that Citrix is one of the most widely used platforms that threat actors are actively looking to exploit so as to steal credentials. In April, the U.S. National Security Agency (NSA) issued an alert warning that nation-state actors were exploiting vulnerabilities that affect VPNs, collaboration-suite software and virtualization technologies.
Join Threatpost for “Fortifying Your Business Against Ransomware, DDoS & Cryptojacking Attacks” a LIVE roundtable event on Wednesday, May 12 at 2:00 PM EDT for this FREE webinar sponsored by Zoho ManageEngine.
That included Citrix, along with Fortinet, Pulse Secure, Synacor and VMware, all of them being in the crosshairs of the advanced persistent threat (APT) group known as APT29 (a.k.a. Cozy Bear or The Dukes). The NSA said at the time that APT29 is conducting “widespread scanning and exploitation against vulnerable systems in an effort to obtain authentication credentials to allow further access.”
Starving Student Was Hungry for a ‘Deal’
In this case, the student was looking for a personal copy of a data visualization software tool the person was already using for work. The license would have cost hundreds of dollars per year, so the student started looking around for a free alternative. When the kid didn’t find that in legitimate form, the hunt was on for a cracked version of the software.
Unfortunately, the student found one. Also unfortunately, he or she apparently wasn’t aware of how evil cracked software can be. Cracking software has led to the evolution of badware such as remote-access trojans (RATs) and cryptocurrency stealers as cybercriminals work to make their tools slip through defenses more easily. Cracked apps in and of themselves can also be receptacles to stuff full of malware.
“The file was in fact pure malware,” Sophos researchers said. The student decided to disable Microsoft’s Windows Defender antivirus, which sniffed a threat when the student tried to install it, because hey, free software.
From what security researchers can tell from the laptop – which was handed over for forensics after the ransomware attack unfurled – the student also had to disable the firewall to coax the time-bomb onto the computer.
From Cracked Software to Malware Install
Once installed, the cracked copy of the visualization tool installed an info-stealer that went to work logging keystrokes; stealing browser, cookie and clipboard data; and more. The keylogger also stumbled across the jackpot: The student’s access credentials for the institute’s network.
Fast-forward 15 days, and a remote desktop protocol (RDP) connection was registered on the institute’s network using those stolen credentials. Researchers noted that the connection was made from a computer named after “Totoro,” the adorable and massively popular anime character.
RDPs have been used in plenty of attacks, including being used to exploit BlueKeep. One of the features of RDP, researchers explained, is that a connection also triggers the automatic installation of a printer driver, enabling users to print documents remotely. In this instance, the RDP connection used a Russian-language printer driver that “was likely to be a rogue connection,” they said. Ten days after the RDP connection was made, Ryuk was triggered.
Peter Mackenzie, manager of Rapid Response at Sophos, said that whoever was behind the cracked software was unlikely to be the same threat actor that was behind the resulting Ryuk attack.
“The underground market for previously compromised networks offering attackers easy initial access is thriving, so we believe that the malware operators sold their access on to another attacker,” he wrote in the report. “The RDP connection could have been the access-brokers testing their access.”
Ransomware’s Coming In Fast and Furious
Lesley Carhart, a principal industrial incident responder at Dragos, recently noted how underreported ransomware attacks like this one really are. “This isn’t something that happens to other people,” she said in a Tweet stream on Tuesday. “You’re not too big, too small, too hybrid, too virtualized or too ‘zero trust’. I promise. Things are very bad. Be prepared now and take serious mitigating measures.”
I keep seeing tweet after tweet lately from my fellow incident responders about preparing for and deterring ransomware attacks, and they are *not* kidding. Things are escalating fast – including the brazenness, cruelty, and quantity. Insurers will only pay out when they must.
— Lesley Carhart (@hacks4pancakes) May 5, 2021
There’s no magic bullet, she said. To prevent ransomware attacks, organizations need “basic security hygiene and the investment in enabling it,” she noted, mentioning the same defensive mechanisms that might have helped in this case: “Stuff like MFA on VPN and cloud services, routine backups saved offline, limiting account [permissions], planning for an incident and rebuild.”
What Could Have Kept Ryuk at Bay?
Sophos’s Mackenzie echoes what Carhart said: Robust network authentication and access controls, plus end user training, “might” have prevented this attack from happening. “It serves as a powerful reminder of how important it is to get the security basics right,” he said.
Sophos passed on these recommendations:
Join Threatpost for “Fortifying Your Business Against Ransomware, DDoS & Cryptojacking Attacks” – a LIVE roundtable event on Wed, May 12 at 2:00 PM EDT. Sponsored by Zoho ManageEngine, Threatpost host Becky Bracken moderates an expert panel discussing best defense strategies for these 2021 threats. Questions and LIVE audience participation encouraged. Join the lively discussion and Register HERE for free.