Friday, December 6, 2024
HomeCyber Security NewsCACTUS Hackers Exploiting Software Bug to Attack Corporate Networks

CACTUS Hackers Exploiting Software Bug to Attack Corporate Networks

Published on

SIEM as a Service

Threat actors known as CACTUS orchestrated a sophisticated attack on two companies simultaneously, exploiting a software vulnerability within 24 hours of its disclosure.

This coordinated ransomware attack highlighted organizations’ growing risks in the digital landscape.

The attack involved intricate steps, including infiltrating networks, implanting remote access tools, encrypting workstations, and targeting virtualization infrastructure across different servers.

- Advertisement - SIEM as a Service
virtualization infrastructure
virtualization infrastructure

Rapid Exploitation of Vulnerabilities

The attack began less than 24 hours after disclosing a critical vulnerability in the Ivanti MobileIron Sentry, identified as CVE-2023-38035, with a CVSS score of 9.8.

This flaw allowed attackers to bypass authentication controls and execute code remotely.

The rapid weaponization of this vulnerability underscores a growing trend among cybercriminals to exploit software bugs swiftly, often before organizations can patch them.

ransomware group had targeted only Windows workloads
ransomware group had targeted only Windows workloads

CACTUS’s operation was not only swift but also meticulously coordinated.

The hackers initially infiltrated one organization’s network before moving on to another company within the same group.

Despite the companies operating independently with separate networks, the attackers managed to exploit the interconnectedness of some machines to launch simultaneous attacks on both entities.

The assault was multifaceted, involving data exfiltration and the encryption of workstations and virtual machines, including domain controllers.

Recently, Bitdefender Labs collaborated in an investigation that unfortunately confirms two significant predictions made for 2024: the swift proliferation of opportunistic ransomware and the growing sophistication of cyber attacks.

Key Points:

  • Rapid Response: CACTUS swiftly capitalized on a Remote Code Execution (RCE) vulnerability, emphasizing the need for organizations to address such threats promptly.
  • Meticulous Coordination: The attack was meticulously planned, with synchronized actions on both companies within a five-minute window
  • Expanded Target Scope: CACTUS expanded its targets beyond Windows workloads to include ESXi and Hyper-V hosts, showcasing a broader focus
  • Forensic Expertise: The affected companies sought forensic expertise from Bitdefender Labs instead of paying the ransom, demonstrating a proactive approach to handling cyber threats

Expanding Targets and Sophisticated Tactics

Traditionally focusing on Windows workloads, CACTUS has expanded its scope to include ESXi and Hyper-V hosts, indicating a broader targeting strategy.

The group employed various remote access tools and tunnels, demonstrating high sophistication in maintaining persistence within compromised networks.

This operation’s success was partly due to using legitimate tools for remote access, such as AnyDesk, and the exploitation of security servers as gateways for further attacks.

The CACTUS ransomware attack is a stark reminder of the evolving threat landscape and the need for organizations to remain vigilant.

It emphasizes the criticality of promptly addressing known vulnerabilities and the benefits of employing robust cybersecurity defenses.

As cybercriminals continue to refine their tactics, the collaborative efforts of security professionals and the adoption of advanced protection technologies will be paramount in safeguarding against such sophisticated threats.        

IOCs

NameTypeHash
C:\windows\{Victim ID}.exeFile39fe99d2250954a0d5ed0e9ff9c41d81
C:\Windows\{Victim ID}.exeFile0e4ee38fe320cfb573a30820198ff442
./{Victim ID}File8d2e4bef47e3f2ee0195926bbf4a25d5
C:\WINDOWS\so.batFilef7a6d1e6e5436bd3c10f3a26f3e9b9b9
C:\WINDOWS\f2.batFilefb467a07f44e8d58e93e3567fd7ff016
c:\user\public\syslog.txtFilebe139fc480984eb31de025f25a191035
c:\users\public\bk11.ps1File08d2c800c93015092e14738c941ac492
02e4da16377fc85e71a8c8378b2a8a96
Psnmap.ps1File8b37df9d295bbc2906961f72b7cdc5fb
Psnmap.ps1File8af259ad55c3746926e992c82bc7e850
Psnmap.ps1File55e42014424c0d120ff17f11e207e4f0
Psnmap.ps1File5f7c3cda7759ef6e577552ad322c1f64
64.52.80.252C2
162.33.177.56C2
45.61.138.99C2
206.188.196.20C2
45.61.136.79C2
45.61.136.127C2
85.206.172.127Attacker IP
192.227.190.11Attacker IP
154.18.12.125Attacker IP
Win64Scheduled Task
Win32Scheduled Task
WindowsScheduled Task
UpdateScheduled Task
Windows UpdateScheduled Task
Microsoft UpdateScheduled Task
GoogleUpdateTaskMachineScheduled Task

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Top Five Industries Most Frequently Targeted by Phishing Attacks

Researchers analyzed phishing attacks from Q3 2023 to Q3 2024 and identified the top...

Russian BlueAlpha APT Exploits Cloudflare Tunnels to Distribute Custom Malware

BlueAlpha, a Russian state-sponsored group, is actively targeting Ukrainian individuals and organizations by using...

Russian Hackers Hijacked Pakistani Actor Servers For C2 Communication

Secret Blizzard, a Russian threat actor, has infiltrated 33 command-and-control (C2) servers belonging to...

Sophisticated Celestial Stealer Targets Browsers to Steal Login Credentials

Researchers discovered Celestial Stealer, a JavaScript-based MaaS infostealer targeting Windows systems that, evading detection...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

Top Five Industries Most Frequently Targeted by Phishing Attacks

Researchers analyzed phishing attacks from Q3 2023 to Q3 2024 and identified the top...

Russian BlueAlpha APT Exploits Cloudflare Tunnels to Distribute Custom Malware

BlueAlpha, a Russian state-sponsored group, is actively targeting Ukrainian individuals and organizations by using...

Russian Hackers Hijacked Pakistani Actor Servers For C2 Communication

Secret Blizzard, a Russian threat actor, has infiltrated 33 command-and-control (C2) servers belonging to...