BlackByte ransomware exploits Microsoft Servers ProxyShell Vulnerabilities

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

BlackByte ransomware is targeting organizations with unpatched ProxyShell vulnerabilities. Proxy Shell was addressed by hive pro threat researcher in the previous advisory released on August 24.

ProxyShell is a combination of three flaws in Microsoft Exchange:

CVE-2021-34473 Pre-auth path confusion vulnerability to bypass access control.
CVE-2021-34523 Privilege escalation vulnerability in the Exchange PowerShell backend.
CVE-2021-31207 Post-auth remote code execution via arbitrary file write.

These security flaws are used together by threat actors to perform unauthenticated, remote code execution on vulnerable servers. After exploiting these vulnerabilities, the threat actors then install web shells, coin miners, ransomwares or backdoors on the servers. Attackers then use this web shell to deploy cobalt strike beacon into Windows Update Agent and get the credentials for a service account on compromised servers. The actor then installs Anydesk to gain control of the system and do lateral movement in the organization network. Post exploitation, attackers carry on with using Cobalt Strike to execute the Blackbyte ransomware and encrypt the data.

Affected organizations can decrypt their files using a free decryption tool written by Trustwave. Users can patch their server for ProxyShell vulnerabilities using the link down below.

Techniques used by Blackbyte ransomware are :

T1505.003 Server Software Component: Web Shell
T1055 Process Injection
T1059.001 Command and Scripting Interpreter: PowerShell
T1595.002 Active Scanning: Vulnerability Scanning
T1027 Obfuscated Files of Information
T1490 Inhibit System Recovery
T1112 Modify Registry
T1562.001 Impair Defenses: Disable or Modify Tools
T1562.004 Impair Defenses: Disable or Modify System Firewall
T1018 Remote System Discovery
T1016 System Network Configuration Discovery
T1070.004 Indicator Removal on Host: File Deletion
T1560.001 Archive Collected Data: Archive via Utility

Vulnerability Details

Actor Detail

Indicators of Compromise(IoCs)

Patch Link

<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34473&gt;

<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34523&gt;

<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31207&gt;

References

<https://redcanary.com/blog/blackbyte-ransomware/&gt;

<https://www.techtarget.com/searchsecurity/news/252510334/BlackByte-ransomware-attacks-exploiting-ProxyShell-flaws&gt;

<https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware/&gt;

<https://www.stellarinfo.com/blog/blackbyte-ransomware-attacks-exchange-servers-with-proxyshell-flaws/&gt;