[ad_1]
Menace actors have revived an outdated and comparatively inactive ransomware household often known as TellYouThePass, deploying it in assaults towards Home windows and Linux units concentrating on a crucial distant code execution bug within the Apache Log4j library.
KnownSec 404 Workforce’s Heige first reported these assaults on Twitter on Monday after observing that the ransomware was dropped on outdated Home windows programs utilizing exploits concentrating on the flaw tracked as CVE-2021-44228 and often known as Log4Shell.
Heige’s report was confirmed by the Sangfor Menace Intelligence Workforce, who efficiently captured one of many TellYouThePass ransomware samples deployed in assaults utilizing Log4Shell exploits, based on Curated Intelligence.
As they additional found (findings that CronUP’s Germán Fernández additionally confirmed), the ransomware has a Linux model that harvests SSH keys and strikes laterally all through victims’ networks.
“It’s price noting that this isn’t the primary time that Tellyouthepass ransomware has used high-risk vulnerabilities to launch assaults,” Sangfor researchers stated. “As early as final 12 months, it had used Everlasting Blue vulnerabilities to assault a number of organizational models.”
Different safety researchers [1, 2] have additionally analyzed one of many ransomware samples deployed in these assaults and tagged it as “doubtless belonging” to the TellYouThePass household.
In keeping with submission stats to the ID Ransomware service, TellYouThePass ransomware has seen a large and sudden spike in exercise after Log4Shell proof-of-concept exploits have been launched on-line.
Log4Shell exploited in ransomware assaults
TellYouThePass shouldn’t be the primary ransomware pressure deployed in Log4Shell assaults since financially-motivated attackers started injecting Monero miners on compromised programs and state-backed hackers began exploiting it to create footholds for follow-on exercise.
BitDefender first reported they discovered a brand new ransomware household (tagged by some as a wiper) they dubbed Khonsari being put in straight by way of Log4Shell exploits.
The Microsoft 365 Defender Menace Intelligence Workforce additionally noticed Khonsari ransomware payloads dropped on self-hosted Minecraft servers.
Final however not least, Conti ransomware operators have additionally added a Log4Shell exploit to their arsenal to maneuver laterally via targets’ networks, acquire entry to VMware vCenter Server cases, and encrypt digital machines.
In associated information, CISA ordered Federal Civilian Government Department businesses right this moment to patch their programs towards the Log4Shell vulnerability throughout the subsequent six days, till December 23.
The cybersecurity company has additionally lately added the flaw to its Identified Exploited Vulnerabilities Catalog, which additionally requires expedited motion from federal businesses to mitigate the bug till December 24.
[ad_2]
