Friday, March 29, 2024

New Sodin Ransomware Exploits Windows Vulnerability to Elevate Privilege and Lock All the Files

Researchers discovered a new Sodin Ransomware (also known as Sodinokibi) that exploits the Windows Elevation privilege vulnerability resides in the Win32k component.

Sodin ransomware initial attack spotted in April 2019 when it was distributed through an Oracle Weblogic vulnerability to attack MSP providers.

Now it turns into a new form of attack by exploiting the Windows vulnerability, and targeting victims were located in the Asia-Pacific region: Taiwan, Hong Kong, and South Korea.

Researchers named the ransomware as Trojan-Ransom.Win32.Sodin that is using the vulnerability (CVE-2018-8453) in Win32k to escalate the highest level of privileges.

The vulnerability initially reported by Kaspersky and the Microsoft fixed this vulnerability was fixed on August 17, 2018.

An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode then install programs, view, change, or delete data; or create new accounts with full user rights.

Sodin Ransomware Infection Process

Attackers configured the initial stage of Trojan distributed with encrypted form and the configuration block containing the settings and data.

Attackers employed the Salsa20 symmetric stream algorithm to encrypt the victim’s files and the keys for it with an elliptic curve asymmetric algorithm.

According to Kaspersky research, “Once the Trojan gets launched, it generates a new pair of elliptic curve session keys, in which the public key of this pair is saved in the registry under the name pk_key and the private key is encrypted using the ECIES algorithm  and stored in the registry under the name sk_key.”

Once the Sodin Ransomware starts the encryption process, it will generate the new paid of elliptic curve asymmetric keys, and the symmetric key will encrypt the victims file contents with the Salsa20 algorithm.

After the ransomware completely encryption the files, the new extension will be applied in each file and the ransom note is saved next to it while malware-generated wallpaper is set on the desktop.

Ransom Notes

Meanwhile, behalf of network communication, Trojan sends information about the infected machine to the attacker’s command and control server and the sending data is also encrypted.

Attackers instruct to pay the ransom amount by giving a website, in which victims find the step to recover the decryption key to unlock the encrypted files.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read:

NCSC Issued an Emergency Alert for Ryuk Ransomware that Actively Attacks on Global Organizations

End of GandCrab – New Free Decryptor Tool that let Victims to Unlock All versions of Ransomware Infection

Ransomware Attack Response and Mitigation Checklist

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles