Hackers exploit social engineering, which avoids technical security systems, by manipulating the psychology and behavior of a human being.
Social engineering techniques, such as baiting emails or pretexting phone calls, manipulate victims into providing confidential information or performing actions that impede security details.
Attackers find it cheap and easy, as they need less specialist knowledge to make expensive use of trust, curiosity, or fear to trick their target.
Cybersecurity analysts at Rapid7 recently identified that threat actors have been actively exploiting a new social engineering attack that delivers Black Basta ransomware.
Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers
Rapid7 has uncovered multiple social engineering campaigns targeting several MDR clients.
Here, the spam emails flood the victims’ inboxes to make them accept remote access via tools such as AnyDesk or Quick Assist when someone pretending to be IT support calls them.
Once connected, the attacker downloads payloads to harvest credentials and maintain persistence, which could ultimately result in ransomware viruses, as in previous Black Basta operations.
This is a new take on things as it emerged towards the end of April 2024.
The attack begins by attacking affected users with a surge of seemingly harmless newsletter signup confirmation spam emails that bypass email protections.
Next, the attacker makes phone calls to people who are directly affected, and they pretend to be IT support in order to resolve this email issue.
Using social engineering, the hijacker persuades users to permit remote access through AnyDesk or Windows Quick Assist.
If one user does not succeed, the attacker immediately proceeds to the next targeted through spam campaigns.
Upon access acquisition, the infiltrator executes batch scripts that look like updates to make them appear genuine. The initial script tests C2 connectivity and downloads an OpenSSH for:-
Registry run keys pointing to extra batch files ensure persistence. These scripts loop over SSH attempts at reverse shell connections to C2 using downloaded keys.
Some of these scripts have hard C2 coding, while others can be overridden through command-line functions. Other versions also achieve persisting via NetSupport or ScreenConnect functionalities.
In all the instances, the attacker utilized a batch script that seemed like an “update” to harvest the victims’ credentials through PowerShell, with most of them being exfiltrated immediately by means of SCP.
Aiming to move laterally, after being compromised initially, there were attempts to deploy Cobalt Strike beacons that consisted of DLL side-loading.
Although no data theft or ransomware was deployed, the indicators match previous Black Basta operations based on intelligence.
Here below, we have mentioned all the mitigations provided:-
On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free
Google has officially launched Vanir, an open-source security patch validation tool designed to streamline and automate…
A newly disclosed transaction-relay jamming vulnerability has raised concerns about the security of Bitcoin nodes,…
Raspberry Pi, a pioneer in affordable and programmable computing, has once again elevated its game…
Qlik has identified critical vulnerabilities in its Qlik Sense Enterprise for Windows software that could…
QNAP Systems, Inc. has identified multiple high-severity vulnerabilities in its operating systems, potentially allowing attackers…
Imagine this: It's a typical Tuesday morning in a bustling hospital. Doctors make their rounds,…