Saturday, July 13, 2024

New Sodin Ransomware Exploits Windows Vulnerability to Elevate Privilege and Lock All the Files

Researchers discovered a new Sodin Ransomware (also known as Sodinokibi) that exploits the Windows Elevation privilege vulnerability resides in the Win32k component.

Sodin ransomware initial attack spotted in April 2019 when it was distributed through an Oracle Weblogic vulnerability to attack MSP providers.

Now it turns into a new form of attack by exploiting the Windows vulnerability, and targeting victims were located in the Asia-Pacific region: Taiwan, Hong Kong, and South Korea.

Researchers named the ransomware as Trojan-Ransom.Win32.Sodin that is using the vulnerability (CVE-2018-8453) in Win32k to escalate the highest level of privileges.

The vulnerability initially reported by Kaspersky and the Microsoft fixed this vulnerability was fixed on August 17, 2018.

An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode then install programs, view, change, or delete data; or create new accounts with full user rights.

Sodin Ransomware Infection Process

Attackers configured the initial stage of Trojan distributed with encrypted form and the configuration block containing the settings and data.

Attackers employed the Salsa20 symmetric stream algorithm to encrypt the victim’s files and the keys for it with an elliptic curve asymmetric algorithm.

According to Kaspersky research, “Once the Trojan gets launched, it generates a new pair of elliptic curve session keys, in which the public key of this pair is saved in the registry under the name pk_key and the private key is encrypted using the ECIES algorithm  and stored in the registry under the name sk_key.”

Once the Sodin Ransomware starts the encryption process, it will generate the new paid of elliptic curve asymmetric keys, and the symmetric key will encrypt the victims file contents with the Salsa20 algorithm.

After the ransomware completely encryption the files, the new extension will be applied in each file and the ransom note is saved next to it while malware-generated wallpaper is set on the desktop.

Ransom Notes

Meanwhile, behalf of network communication, Trojan sends information about the infected machine to the attacker’s command and control server and the sending data is also encrypted.

Attackers instruct to pay the ransom amount by giving a website, in which victims find the step to recover the decryption key to unlock the encrypted files.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read:

NCSC Issued an Emergency Alert for Ryuk Ransomware that Actively Attacks on Global Organizations

End of GandCrab – New Free Decryptor Tool that let Victims to Unlock All versions of Ransomware Infection

Ransomware Attack Response and Mitigation Checklist


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles