‛Fog’ Ransomware Rolls in to Target many Sectors. A new group of hackers is encrypting data in virtual machines, leaving ransom notes, and calling it a day. A new ransomware operation has been performing old-fashioned ransomware attacks, locking up data in virtual environments to earn quick payouts.
Attack Vectors
• Fog attacks typically begin with stolen virtual private network (VPN) credentials, an increasingly popular means of initial access into sizable organizations. The group has exploited two different VPN gateway vendors thus far, which Arctic Wolf has declined to name.
• In one case, for example, Fog passed the hash to compromise administrator accounts in its target’s
network. It then used the accounts to establish a remote desktop protocol (RDP) connection with Windows servers running the Hyper-V hypervisor and Veeam data protection software.
• Other common Fog tactics, techniques, and procedures (TTPs) include credential stuffing, using native Windows and open-source tools like Metasploit and PsExec, disabling Windows Defender, and using Tor to communicate with victims.
• Contrary to recent trends, Fog does not exfiltrate the data it encrypts. It does not operate a leak site,
perform double or triple extortion, or anything of the sort. “Considering the short duration between initial intrusion and encryption, the threat actors appear more interested in a quick payout as opposed to exacting a more complex attack,” the researchers assessed.
Recommendation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Maintain cyber hygiene by updating your anti-virus software and implementing a patch management
lifecycle.
- Along with network and system hardening, code hardening should be implemented within the organization
so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the
deployed codes.
- Enable two-factor authentication.
- In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them.
That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them
regularly.
- Emails from unknown senders should always be treated with caution
NOTE: The recommended settings/controls should be implemented after due shall be tested on Pre-Prod or
test environment before implementing. diligence and impact analysis.
Refer to the links for further information:-
Comments
Post a Comment