The newly observed “LockFile” ransomware has skilfully infiltrated multiple sectors by exploiting the “PetitPotam” vulnerability in Microsoft Windows systems. In complex and technically sophisticated supply-chain attacks, cyber-threat actors gained access to targets’ Microsoft Exchange Servers, making use of a publicly available PetitPotam proof of concept (PoC) to access domain controllers and deploy LockFile. The multiple, domino-like layers of the attacks signify the increasingly advanced capabilities of ransomware and ransomware operators alike. They have raised a red flag for defenders, who should strive to be as agile and resourceful as attackers―as well as one step ahead, when it comes to preventing vulnerability exploitation.
Most Recent Flipbooks
The well-established “Mozi” peer-to-peer (P2P) botnet has developed new persistence capabilities.
A configurable, malicious Traffic Direction System (TDS) has been enabling widespread malware attacks.
A years-long reconnaissance campaign against an employee of a US aerospace defense company was discovered and attributed to “TA456”, an Iranian state-backed advanced persistent threat (APT) group.
The new “BlackMatter”, “Haron”, and “El_Cometa” ransomware groups, which surfaced in the past three weeks, bear significant similarities to ransomware groups that disappeared last month
A vulnerability in Kaseya’s virtual system/server administrator (VSA) software has been exploited to deliver the “REvil” ransomware to multiple managed service providers.