Article 5GABZ How a VPN vulnerability allowed ransomware to disrupt two manufacturing plants

How a VPN vulnerability allowed ransomware to disrupt two manufacturing plants

by
Dan Goodin
from Ars Technica - All content on (#5GABZ)
manufacturing-800x534.jpeg

Enlarge (credit: Getty Images)

Ransomware operators shut down two production facilities belonging to a European manufacturer after deploying a relatively new strain that encrypted servers that control a manufacturer's industrial processes, a researcher from Kaspersky Lab said on Wednesday.

The ransomware, known as Cring, came to public attention in a January blog post. It takes hold of networks by exploiting long-patched vulnerabilities in VPNs sold by Fortinet. Tracked as CVE-2018-13379, the directory transversal vulnerability allows unauthenticated attackers to obtain a session file that contains the username and plaintext password for the VPN.

With an initial toehold, a live Cring operator performs reconnaissance and uses a customized version of the Mimikatz tool in an attempt to extract domain administrator credentials stored in server memory. Eventually, the attackers use the Cobalt Strike framework to install Cring. To mask the attack in progress, the hackers disguise the installation files as security software from Kaspersky Lab or other providers.

Read 9 remaining paragraphs | Comments

index?i=58JgIiOePuA:cbkXPgOuAMU:V_sGLiPB index?i=58JgIiOePuA:cbkXPgOuAMU:F7zBnMyn index?d=qj6IDK7rITs index?d=yIl2AUoC8zA
External Content
Source RSS or Atom Feed
Feed Location http://feeds.arstechnica.com/arstechnica/index
Feed Title Ars Technica - All content
Feed Link https://arstechnica.com/
Reply 0 comments