Friday, November 1, 2024
HomeCyber Security NewsCACTUS Hackers Exploiting Software Bug to Attack Corporate Networks

CACTUS Hackers Exploiting Software Bug to Attack Corporate Networks

Published on

Malware protection

Threat actors known as CACTUS orchestrated a sophisticated attack on two companies simultaneously, exploiting a software vulnerability within 24 hours of its disclosure.

This coordinated ransomware attack highlighted organizations’ growing risks in the digital landscape.

The attack involved intricate steps, including infiltrating networks, implanting remote access tools, encrypting workstations, and targeting virtualization infrastructure across different servers.

- Advertisement - SIEM as a Service
virtualization infrastructure
virtualization infrastructure

Rapid Exploitation of Vulnerabilities

The attack began less than 24 hours after disclosing a critical vulnerability in the Ivanti MobileIron Sentry, identified as CVE-2023-38035, with a CVSS score of 9.8.

This flaw allowed attackers to bypass authentication controls and execute code remotely.

The rapid weaponization of this vulnerability underscores a growing trend among cybercriminals to exploit software bugs swiftly, often before organizations can patch them.

ransomware group had targeted only Windows workloads
ransomware group had targeted only Windows workloads

CACTUS’s operation was not only swift but also meticulously coordinated.

The hackers initially infiltrated one organization’s network before moving on to another company within the same group.

Despite the companies operating independently with separate networks, the attackers managed to exploit the interconnectedness of some machines to launch simultaneous attacks on both entities.

The assault was multifaceted, involving data exfiltration and the encryption of workstations and virtual machines, including domain controllers.

Recently, Bitdefender Labs collaborated in an investigation that unfortunately confirms two significant predictions made for 2024: the swift proliferation of opportunistic ransomware and the growing sophistication of cyber attacks.

Key Points:

  • Rapid Response: CACTUS swiftly capitalized on a Remote Code Execution (RCE) vulnerability, emphasizing the need for organizations to address such threats promptly.
  • Meticulous Coordination: The attack was meticulously planned, with synchronized actions on both companies within a five-minute window
  • Expanded Target Scope: CACTUS expanded its targets beyond Windows workloads to include ESXi and Hyper-V hosts, showcasing a broader focus
  • Forensic Expertise: The affected companies sought forensic expertise from Bitdefender Labs instead of paying the ransom, demonstrating a proactive approach to handling cyber threats

Expanding Targets and Sophisticated Tactics

Traditionally focusing on Windows workloads, CACTUS has expanded its scope to include ESXi and Hyper-V hosts, indicating a broader targeting strategy.

The group employed various remote access tools and tunnels, demonstrating high sophistication in maintaining persistence within compromised networks.

This operation’s success was partly due to using legitimate tools for remote access, such as AnyDesk, and the exploitation of security servers as gateways for further attacks.

The CACTUS ransomware attack is a stark reminder of the evolving threat landscape and the need for organizations to remain vigilant.

It emphasizes the criticality of promptly addressing known vulnerabilities and the benefits of employing robust cybersecurity defenses.

As cybercriminals continue to refine their tactics, the collaborative efforts of security professionals and the adoption of advanced protection technologies will be paramount in safeguarding against such sophisticated threats.        

IOCs

NameTypeHash
C:\windows\{Victim ID}.exeFile39fe99d2250954a0d5ed0e9ff9c41d81
C:\Windows\{Victim ID}.exeFile0e4ee38fe320cfb573a30820198ff442
./{Victim ID}File8d2e4bef47e3f2ee0195926bbf4a25d5
C:\WINDOWS\so.batFilef7a6d1e6e5436bd3c10f3a26f3e9b9b9
C:\WINDOWS\f2.batFilefb467a07f44e8d58e93e3567fd7ff016
c:\user\public\syslog.txtFilebe139fc480984eb31de025f25a191035
c:\users\public\bk11.ps1File08d2c800c93015092e14738c941ac492
02e4da16377fc85e71a8c8378b2a8a96
Psnmap.ps1File8b37df9d295bbc2906961f72b7cdc5fb
Psnmap.ps1File8af259ad55c3746926e992c82bc7e850
Psnmap.ps1File55e42014424c0d120ff17f11e207e4f0
Psnmap.ps1File5f7c3cda7759ef6e577552ad322c1f64
64.52.80.252C2
162.33.177.56C2
45.61.138.99C2
206.188.196.20C2
45.61.136.79C2
45.61.136.127C2
85.206.172.127Attacker IP
192.227.190.11Attacker IP
154.18.12.125Attacker IP
Win64Scheduled Task
Win32Scheduled Task
WindowsScheduled Task
UpdateScheduled Task
Windows UpdateScheduled Task
Microsoft UpdateScheduled Task
GoogleUpdateTaskMachineScheduled Task

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...