The newly observed “LockFile” ransomware has skilfully infiltrated multiple sectors by exploiting the “PetitPotam” vulnerability in Microsoft Windows systems. In complex and technically sophisticated supply-chain attacks, cyber-threat actors gained access to targets’ Microsoft Exchange Servers, making use of a publicly available PetitPotam proof of concept (PoC) to access domain controllers and deploy LockFile. The multiple, domino-like layers of the attacks signify the increasingly advanced capabilities of ransomware and ransomware operators alike. They have raised a red flag for defenders, who should strive to be as agile and resourceful as attackers―as well as one step ahead, when it comes to preventing vulnerability exploitation.
Digital Shadows
Threat Intelligence and Digital Risk Protection Resources
