Pulse Secure VPN Vulnerabilities Leveraged by Black Kingdom Ransomware

Latest findings

• In June 2020, Black Kingdom ransomware operators gained initial access to enterprise infrastructures via Pulse Secure VPN vulnerability (CVE-2019-11510) by impersonating a legitimate scheduled task for Google Chrome, with a single letter making the difference.
• REDTEAM.PL researchers found that the malicious task was named GoogleUpdateTaskMachineUSA, which was trying to pose as the legitimate task ‘GoogleUpdateTaskMachineUA’.
• The malicious Black Kingdom task ‘GoogleUpdateTaskMachineUSA’ executes a PowerShell code that downloads a script named “reverse.ps1,” to open a reverse shell on a haсked host.

Not a new vulnerability

• In May 2020, a ransomware attack targeted a law firm Grubman Shire Meiselas & Sacks as one of its associated domains was using an unpatched Pulse Secure VPN server.
• In April 2020, hackers used stolen Active Directory credentials to deploy a ransomware attack on the systems of U.S. hospitals and government entities after exploiting the vulnerability in associated Pulse Secure VPN servers.
• In January 2020, REvil (Sodinokibi) ransomware attacked Travelex by leveraging the vulnerability in Pulse Secure VPN enterprise solution. In the same month, the ransomware operators exploited unpatched Pulse Secure VPN servers to gain a foothold and disable antivirus.

Immediate action required