Monday, November 4, 2024
HomeComputer SecurityNew Sodin Ransomware Exploits Windows Vulnerability to Elevate Privilege and Lock All...

New Sodin Ransomware Exploits Windows Vulnerability to Elevate Privilege and Lock All the Files

Published on

Malware protection

Researchers discovered a new Sodin Ransomware (also known as Sodinokibi) that exploits the Windows Elevation privilege vulnerability resides in the Win32k component.

Sodin ransomware initial attack spotted in April 2019 when it was distributed through an Oracle Weblogic vulnerability to attack MSP providers.

Now it turns into a new form of attack by exploiting the Windows vulnerability, and targeting victims were located in the Asia-Pacific region: Taiwan, Hong Kong, and South Korea.

- Advertisement - SIEM as a Service

Researchers named the ransomware as Trojan-Ransom.Win32.Sodin that is using the vulnerability (CVE-2018-8453) in Win32k to escalate the highest level of privileges.

The vulnerability initially reported by Kaspersky and the Microsoft fixed this vulnerability was fixed on August 17, 2018.

An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode then install programs, view, change, or delete data; or create new accounts with full user rights.

Sodin Ransomware Infection Process

Attackers configured the initial stage of Trojan distributed with encrypted form and the configuration block containing the settings and data.

Attackers employed the Salsa20 symmetric stream algorithm to encrypt the victim’s files and the keys for it with an elliptic curve asymmetric algorithm.

According to Kaspersky research, “Once the Trojan gets launched, it generates a new pair of elliptic curve session keys, in which the public key of this pair is saved in the registry under the name pk_key and the private key is encrypted using the ECIES algorithm  and stored in the registry under the name sk_key.”

Once the Sodin Ransomware starts the encryption process, it will generate the new paid of elliptic curve asymmetric keys, and the symmetric key will encrypt the victims file contents with the Salsa20 algorithm.

After the ransomware completely encryption the files, the new extension will be applied in each file and the ransom note is saved next to it while malware-generated wallpaper is set on the desktop.

Ransom Notes

Meanwhile, behalf of network communication, Trojan sends information about the infected machine to the attacker’s command and control server and the sending data is also encrypted.

Attackers instruct to pay the ransom amount by giving a website, in which victims find the step to recover the decryption key to unlock the encrypted files.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read:

NCSC Issued an Emergency Alert for Ryuk Ransomware that Actively Attacks on Global Organizations

End of GandCrab – New Free Decryptor Tool that let Victims to Unlock All versions of Ransomware Infection

Ransomware Attack Response and Mitigation Checklist

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Threat Actors Allegedly Claiming Leak of Dell Partner Portal Data

A well-known dark web forum threat actor allegedly claimed responsibility for leaking data from...

Securing Your SaaS Application Security

The rapid growth of cloud computing has made SaaS applications indispensable across industries. While...

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Threat Actors Allegedly Claiming Leak of Dell Partner Portal Data

A well-known dark web forum threat actor allegedly claimed responsibility for leaking data from...

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...