Conti ransomware is exploiting the Log4Shell vulnerability to the tune of thousands and thousands

Log4Shell is essentially the most extreme vulnerability hitting techniques in the long run of 2021. Since its public publicity on the December 9, the safety business has labored onerous to attempt to patch and defend towards it. However certain sufficient, cybercriminals have began utilizing it, and it was solely a matter of time earlier than one of the crucial energetic ransomware teams started to take advantage of it too.

What’s the Log4Shell vulnerability?

The Log4Shell vulnerability (CVE-2021-44228) impacts the log4j Java library, which is utilized by a variety of software program. Thousands and thousands of techniques worldwide use a susceptible model of this library and are in danger.

Safety supplier Cloudflare says in a weblog put up that it is seeing the exploitation sample in log information as much as 1,000 occasions per second.

What makes it so extreme is that it permits an attacker to simply launch distant code on the machine operating the susceptible library. It doesn’t take a variety of technical expertise to take advantage of it, so it’s accessible to actually any form of attacker, technically good or not.

SEE: NIST Cybersecurity Framework: A cheat sheet for professionals (free PDF) (TechRepublic)

Conti ransomware

AdvIntel reported {that a} week after the vulnerability turned public, it began being utilized by one of the crucial prolific organized Russian-speaking ransomware teams: Conti.

The group behind Conti ransomware is effectively structured. Its enterprise mannequin is to supply the Conti ransomware-as-a-service (RaaS). On this mannequin, the cybercriminals working Conti allow associates to make use of it as desired, supplied {that a} share of the ransom fee is shared with them.

Between July and November 2021, the group is estimated to have acquired $25.5 million from ransom funds, in keeping with cryptocurrency transactions investigations from Swiss firm PRODAFT, whereas AdvIntel estimates that Conti revamped $150 million within the final six months.

Conti makes use of the “double extortion” scheme: If corporations don’t pay the ransom, not solely is their knowledge misplaced, but it surely’s additionally uncovered publicly on the web or bought to opponents, for the reason that group took care of exfiltrating all of the encrypted knowledge on its infrastructure.

Information on the Conti group grew immediately when one disgruntled affiliate of the construction immediately leaked materials from Conti. The leak contained paperwork principally written in Cyrillic and uncovered a full playbook to compromise corporations and infect them with ransomware, making it uncomfortably simple for any hacker talking the language, even with low safety and community expertise.

The Conti group appears to be eager on at all times discovering new methods to contaminate corporations and unfold their ransomware, as they typically have leveraged exploits as preliminary compromise vectors.

Utilizing the Log4Shell vulnerability, the group particularly focused VMware vCenter servers. The exploit was used to get entry to the server after which be capable to transfer laterally throughout the focused firm’s community. This can be a notable distinction in comparison with different exploits they may use: This one is devoted to shifting laterally contained in the compromised community; the attackers have already efficiently obtained preliminary entry to the company community.

That is by far the most important and most profitable use of the Log4Shell vulnerability, for the reason that penalties of its use could be extra corporations having their enterprise being disrupted. A few of them will in all probability select to pay the ransom to return to regular and never have their knowledge uncovered on the web.

The cybercriminals may also consider different methods to take advantage of the Log4Shell vulnerability, as software program apart from vCenter is susceptible, even for the preliminary compromise stage of their assaults.

SEE: Patch administration coverage (TechRepublic Premium)

Learn how to defend your self from the Log4Shell assaults

VMware already supplied directions to deal with the vulnerability in vCenter servers and vCenter Cloud Gateways.

Much more software program is susceptible. It’s suggested to examine usually for updates on susceptible merchandise and patch or deploy workarounds as quickly as potential. A complete listing of impacted software program is supplied by US CISA.

Log4Shell-specific testing software program is supplied by a number of safety corporations for IT workers who need to examine whether or not their techniques are impacted and can be utilized to detect susceptible techniques.

Cybereason provides a “vaccine” to forestall the vulnerability from being triggered, but it surely ought to be seen solely as a brief measure till all techniques are patched.

Learn how to defend your self from ransomware

• Maintain all techniques and software program updated.
• Conduct safety audits and repair no matter safety drawback seems.
• Carry out common backups, however maintain them offline as a lot as potential, as ransomware is commonly on the lookout for backup techniques and destroying it.
• Cut back the assault floor by rigorously disabling any protocol or system that’s not wanted. For instance, if FTP just isn’t wanted someplace, disable it.
• Allow double issue authentication (2FA) every time potential, particularly for distant entry connections.
• Prohibit privileges of customers to solely the content material they should work.
• Use intrusion prevention techniques (IPS) / intrusion detection techniques (IDS).
• Run safety consciousness packages for all staff.

Disclosure: I work for Development Micro, however the views expressed on this article are mine.

Cybersecurity Insider Publication

Strengthen your group’s IT safety defenses by preserving abreast of the most recent cybersecurity information, options, and greatest practices.
Delivered Tuesdays and Thursdays

Join at this time

Additionally see