Saturday, April 13, 2024

CACTUS Hackers Exploiting Software Bug to Attack Corporate Networks

Threat actors known as CACTUS orchestrated a sophisticated attack on two companies simultaneously, exploiting a software vulnerability within 24 hours of its disclosure.

This coordinated ransomware attack highlighted organizations’ growing risks in the digital landscape.

The attack involved intricate steps, including infiltrating networks, implanting remote access tools, encrypting workstations, and targeting virtualization infrastructure across different servers.

virtualization infrastructure
virtualization infrastructure

Rapid Exploitation of Vulnerabilities

The attack began less than 24 hours after disclosing a critical vulnerability in the Ivanti MobileIron Sentry, identified as CVE-2023-38035, with a CVSS score of 9.8.

This flaw allowed attackers to bypass authentication controls and execute code remotely.

The rapid weaponization of this vulnerability underscores a growing trend among cybercriminals to exploit software bugs swiftly, often before organizations can patch them.

ransomware group had targeted only Windows workloads
ransomware group had targeted only Windows workloads

CACTUS’s operation was not only swift but also meticulously coordinated.

The hackers initially infiltrated one organization’s network before moving on to another company within the same group.

Despite the companies operating independently with separate networks, the attackers managed to exploit the interconnectedness of some machines to launch simultaneous attacks on both entities.

The assault was multifaceted, involving data exfiltration and the encryption of workstations and virtual machines, including domain controllers.

Recently, Bitdefender Labs collaborated in an investigation that unfortunately confirms two significant predictions made for 2024: the swift proliferation of opportunistic ransomware and the growing sophistication of cyber attacks.

Key Points:

  • Rapid Response: CACTUS swiftly capitalized on a Remote Code Execution (RCE) vulnerability, emphasizing the need for organizations to address such threats promptly.
  • Meticulous Coordination: The attack was meticulously planned, with synchronized actions on both companies within a five-minute window
  • Expanded Target Scope: CACTUS expanded its targets beyond Windows workloads to include ESXi and Hyper-V hosts, showcasing a broader focus
  • Forensic Expertise: The affected companies sought forensic expertise from Bitdefender Labs instead of paying the ransom, demonstrating a proactive approach to handling cyber threats

Expanding Targets and Sophisticated Tactics

Traditionally focusing on Windows workloads, CACTUS has expanded its scope to include ESXi and Hyper-V hosts, indicating a broader targeting strategy.

The group employed various remote access tools and tunnels, demonstrating high sophistication in maintaining persistence within compromised networks.

This operation’s success was partly due to using legitimate tools for remote access, such as AnyDesk, and the exploitation of security servers as gateways for further attacks.

The CACTUS ransomware attack is a stark reminder of the evolving threat landscape and the need for organizations to remain vigilant.

It emphasizes the criticality of promptly addressing known vulnerabilities and the benefits of employing robust cybersecurity defenses.

As cybercriminals continue to refine their tactics, the collaborative efforts of security professionals and the adoption of advanced protection technologies will be paramount in safeguarding against such sophisticated threats.        

IOCs

NameTypeHash
C:\windows\{Victim ID}.exeFile39fe99d2250954a0d5ed0e9ff9c41d81
C:\Windows\{Victim ID}.exeFile0e4ee38fe320cfb573a30820198ff442
./{Victim ID}File8d2e4bef47e3f2ee0195926bbf4a25d5
C:\WINDOWS\so.batFilef7a6d1e6e5436bd3c10f3a26f3e9b9b9
C:\WINDOWS\f2.batFilefb467a07f44e8d58e93e3567fd7ff016
c:\user\public\syslog.txtFilebe139fc480984eb31de025f25a191035
c:\users\public\bk11.ps1File08d2c800c93015092e14738c941ac492
02e4da16377fc85e71a8c8378b2a8a96
Psnmap.ps1File8b37df9d295bbc2906961f72b7cdc5fb
Psnmap.ps1File8af259ad55c3746926e992c82bc7e850
Psnmap.ps1File55e42014424c0d120ff17f11e207e4f0
Psnmap.ps1File5f7c3cda7759ef6e577552ad322c1f64
64.52.80.252C2
162.33.177.56C2
45.61.138.99C2
206.188.196.20C2
45.61.136.79C2
45.61.136.127C2
85.206.172.127Attacker IP
192.227.190.11Attacker IP
154.18.12.125Attacker IP
Win64Scheduled Task
Win32Scheduled Task
WindowsScheduled Task
UpdateScheduled Task
Windows UpdateScheduled Task
Microsoft UpdateScheduled Task
GoogleUpdateTaskMachineScheduled Task

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter

Website

Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles