Researchers reported last month that Cuba ransomware operators were using the BURNTCIGAR loader utility to install a malicious driver signed using Microsoft's certificate. Now, Microsoft has revealed that the group is targeting vulnerable Exchange servers for a critical Server-Side Request Forgery (SSRF) vulnerability, aka OWASSRF, as well.
The vulnerability was first disclosed in November last year.
Ransomware actors abusing OWASSRF
- Recent reports from Microsoft and other agencies suggest that the Cuba ransomware group is actively expanding its scope by adopting new attack tactics rapidly. This includes the exploitation of new bugs - the most recent being the OWASSRF bug.
- Recently, Cuba operators started exploiting the OWASSRF (CVE-2022-41080) zero-day to compromise vulnerable Microsoft Exchange servers.
- Since its disclosure, the DEV-0671 threat actor has been exploiting this bug to hack Exchange servers and deploy Cuba ransomware payloads.
- Of late, the Play ransomware group abused this same security flaw on Rackspace’s network. The bug was exploited to drop several tools, including Plink and AnyDesk, to gain remote access to the infected servers.
Actions taken so far
- Microsoft released security updates to address this bug in November 2022 and has provided its customers with information about protection from this attack method.
- The CISA added this bug to its Known Exploited Vulnerabilities Catalog and has ordered Federal Civilian Executive Branch Agencies (FCEB) agencies to patch their systems against this bug by January 31.
Conclusion
Cuba ransomware, coupled with a splash of well-adopted and successful crimeware techniques, presents unique challenges to defenders. Last month, the CISA and the FBI issued an alert about rising attacks from the ransomware group. It had targeted CVE-2022-24521 in Windows Common Log File System (CLFS) driver and CVE-2020-1472 (Zerologon) in the Microsoft Netlogon process. Microsoft Exchange users are advised to prioritize the patching of the OWASSRF bug to thwart exploitation attempts.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/0f6c_shutterstock_2005363490.jpeg)
/https://cyware-ent.s3.amazonaws.com/image_bank/da07_shutterstock_1036755457.jpg)
