Hackers breached MSPs and used Webroot console to infect PCs with Sodinokibi ransomware.
The infrastructure of at least three MSPs has been breached, in order to access and deploy ransomware in consumers' systems. The attackers made use of the remote management tool (RDP) - Webroot SecureAnywhere console - to access the consumers' systems.
MSP is for sure an attractive attack destination. Since MSPs operate with a high-level control of their clients, breaching their network gives the attackers a straightforward path to their clients' network. Once the breach is made, attackers can move on to other networks and end-points. Thus, leaving MSPs and their clients vulnerable to data theft threats.
RDP as the Attack Vector:
The hackers breached MSPs via exposed RDP (Remote Desktop Protocol), elevated the privileges inside the system, and uninstalled all anti-virus software, thus allowing them to use Webroot SecureAnywhere remote management software, used by the MSP, to reach remotely located workstations in their customers' network. The hackers leveraged the fact that Webroot's management console allows administrators to remotely download and execute files to endpoints, so the console was used to execute a Powershell script that eventually downloaded and installed the Sodinokibi ransomware on the remote stations.
BlueKeep- Don't let your RDP be the next breach's smoking gun
Sodinokibi Malware:
Sodinokibi ransomware was originally discovered after Oracle WebLogic vulnerability was exploited on April 29th of last year. The ransomware attempts to encrypt data in a user's directory while also deleting shadow copy backups to make data recovery even harder. Oracle patched this vulnerability (CVE-2019-2725) on April 26th and gave it a CVSS score of 9.8/10. This score is high because anyone with HTTP access to the WebLogic server could carry out the attack. Once the server is accessed by the attacker, the attack leads the server to download a copy of the ransomware from the attacker-controlled IP address.
How can you prevent it?
If You're an MSP:
We recently see an emerging trend of using the RDS as an attack vector. New security issues in RDS are constantly being discovered. The only way to protect yourself from RDS vulnerabilities is to make sure it is configured as securely as possible and within the restrictions of your production environment. That's where CHS by CalCom comes in. It does all this automatically for you. CHS will implement the most secure configuration policy without harming your production environment and with no need for you to put any effort into lab testing.
In addition, as much as possible, you should restrict users' accessibility to server configurations, so even if attackers were able to gain administrators' privileges, their access to fundamental assets in the infrastructure will still be denied. CHS will also allow you to control your entire environment server policies from a single user and prevent these exact configuration drifts.
If you’re a client:
The following actions are recommended to prevent a Sodinokiba attack:
- Patch WebLogic against CVE-2019-2725 ASAP.
- Log and collect web, application, and operating system events.
- Restrict access for the account used to run the WebLogic process.
- Restrict egress Data Center communications.
- Control URL access - in this case, restrict external access to "/_async/*" and "/wls-wsat/*".
- Configure PowerShell to execute only signed scripts. Use CHS by CalCom to do this without breaking anything in your production and with no need for lab testing.
- Limit privileges as much as you can. By using CHS, you can control your entire production policies from a single user, shrinking the chances for configuration drifts in cases of a breach or misuse of user privileges.
Conclusions:
There is no news when it comes to your need to protect yourself from RDP potential vulnerabilities. regardless if you are an MSP or not, your RDS is one of your networks' weakest links. Furthermore, configuration drift is a major issue both for the MSP and their clients in this case. Unauthorized changes in your server configuration are devastating for your ability to protect yourself from cyber-attacks.
When it comes to preventing this attack, CHS users can definitely sleep better. CHS will automatically implement the most secure policy on your servers, regardless of servers' role, in the production environment without causing outages. In addition, the entire control of your infrastructure is made by a single administrator, which decreases the risk for configuration drifts significantly.
https://www.passportalmsp.com/blog/beginners-guide-to-hacking-keep-your-msp-safe
https://www.zdnet.com/article/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems/
https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html
