Ransomware gangs increasingly exploiting vulnerabilities

Ransomware groups have increasingly exploited known and zero-day vulnerabilities to gain initial access to victim organizations over the past year, according to new research from Cisco Talos.

In a blog post on Wednesday, James Nutland, Cisco Talos threat intelligence analyst, detailed the tactics, techniques and procedures (TTP) of the 14 most prominent ransomware groups on the threat landscape between 2023 and 2024. Nutland found that LockBit was the most active group during that span, despite multiple recent law enforcement efforts. In addition, Cisco Talos research showed that vulnerability exploitation is the preferred tactic for ransomware actors to gain initial access to a victim environment.

Nutland outlined common ransomware attack chains and provided examples of exploited vulnerabilities, including one known as ZeroLogon that was disclosed and patched in 2020. Ransomware groups went back even further and exploited an old Fortinet FortiOS SSL VPN vulnerability, tracked as CVE-2018-13379, as well.

He emphasized that the timing of the blog coincides with significant attacks, including one against CDK Global last month.

"Talos' studies indicate that the most prolific ransomware actors prioritize gaining initial access to targeted networks, with valid accounts being the most common mechanism. Phishing for credentials often precedes these attacks, a trend observed across all incident response engagements, consistent with our 2023 Year in Review report," Nutland wrote in the blog. "Over the past year, many groups have increasingly exploited known and zero-day vulnerabilities in public-facing applications, making this a prevalent initial access vector."

Nutland stressed that during the research period for this blog, Talos' incident response team was "responding to a considerable number of ransomware attacks heavily targeting the United States." Affected sectors included manufacturing, which other vendors reported as the topmost targeted sector as well. Nutland said that the attacks resulted in "significant levels of financial losses" and operation disruptions for victim organizations.

To gain initial access to those targets, Cisco observed ransomware actors repeatedly exploited three vulnerabilities. The first is an elevation of privilege vulnerability in Microsoft's Netlogon Remote Protocol, tracked as CVE-2020-1472 and otherwise known as Zerologon. Nutland warned that exploitation could allow an attacker to bypass authentication requirements and change passwords through Windows Active Directory.

"Ransomware actors leverage this vulnerability to gain initial access to networks without requiring authentication, quickly escalating privileges to domain administrator levels. This access enables them to manipulate security policies, and potentially disable security defenses, facilitating unobstructed lateral movement and attack progression," Nutland wrote.

The second vulnerability Nutland highlighted was a path traversal flaw in Fortinet's FortiOS SSL VPN, tracked as CVE-2018-13379. He warned that ransomware groups exploit it to obtain sensitive information, including VPN session tokens, that can then be used to gain unauthorized network access.

Following exploitation, Cisco observed the actors move laterally through the victim's network and exploit more vulnerabilities or weak configurations prior to ransomware deployment and data exfiltration.

Lastly, ransomware actors repeatedly exploited a critical flaw in Fortra's GoAnywhere managed file transfer software, tracked as CVE-2023-0669. The Clop ransomware gang initially exploited it as a zero-day vulnerability in January of 2023, and significant fallout mounted as more victims came to light.

"This critical vulnerability enables actors to deploy ransomware payloads directly to servers or use the compromised server as a pivot for further internal reconnaissance and lateral movement. The ability to execute arbitrary code enables attackers to manipulate systems, create backdoors and disable security controls," the blog read.

Exploiting vulnerabilities in publicly facing applications to gain initial access has become a common practice for many threat actors, not just ransomware gangs. A recent joint government advisory warned that the Chinese-state sponsored threat group known as APT40 also prioritizes vulnerability exploitation as an initial access vector.