ProxyShell and PetitPotam exploits weaponized by LockFile Ransomware Group

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

LockFile, a new ransomware gang, has been active since last week. LockFile began by using a publicly disclosed PetitPotam exploit (CVE-2021-36942) to compromise Windows Domain Controllers earlier this week. Using ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207), they've now infiltrated many Microsoft Exchange Servers . The origins of this gang are most likely China. This gang used a similar ransomware note as of LokiBot and is been linked to Conti ransomware due to the email id provided (contact@contipauper[.]com). HivePro Threat Research team advises everyone to patch the vulnerabilities to prevent an attack.

Vulnerability Details

Actor Details

Name |Target Locations|Target Sectors |
—|—|—|—
LockFile Ransomware | United States of America and Asia | Manufacturing, financial services, engineering, legal, business services, and travel and tourism sectors |

Indicators of Compromise (IoCs)

Patch Links

<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34473&gt;

<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34523&gt;

<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36942&gt;

<https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31207&gt;

References

<https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows&gt;

<https://www.bleepingcomputer.com/news/security/lockfile-ransomware-uses-petitpotam-attack-to-hijack-windows-domains/&gt;