Morphisec Knowledge Update: New WastedLocker Ransomware Causes Havoc Among Some of the Leading Enterprises in the U.S. – Security Boulevard

Garmin has confirmed that the recent outage its users experienced was indeed the result of a successful ransomware attack. However, the extent of the damage done is still unclear. The attack, which compromised Garmins servers for five days, impacted millions of users globally and will likely end up costing Garmin millions of dollars in lost productivity and reputation alone. While Garmin says that no customer data was leaked, Garmins call centers, web site, and cloud-based services such as Garmin Connect and FlyGarmin (a commercial aviation navigation service) were either taken offline or negatively impacted as a result of the attack.

According to reliable sources, the Garmin attack appears to have been the result of a successful WastedLocker ransomware infiltration by the notorious Russian cybercrime group known as Evil Corp. The groups apparent success in this recent attack highlights the danger of organized threat actors to companies of all sizes. It also provides a lesson for companies seeking to protect their corporate networks against similar threats. The first step towards improving your own network security is understanding how Garmin fell victim to this attack.

The type of attack chain that Garmin witnessed is likely no different from those experienced by other victims of Evil Corp malware breaches. Like their previous Bitpaymer attacks, Evil Corp spread WastedLocker malware payloads by masquerading them as software or system updates. These malicious updates are delivered via a Javascript-based framework known as SocGholish, which, running under the privileges of a browser user, lures targets into downloading fake updates to applications such as Chrome and Firefox web browsers. Evil Corp has previously used a similar framework to trick targeted users into downloading Dridex malware, Cobalt Strike beacons, Netwire, and more.

While attacks conducted by Evil Corp are often tailored explicitly towards targeted organizations, they tend to follow a similar attack chain:

After its execution, WastedLocker will attempt to encrypt all the files it can access within the infected target network while deleting shadow files and backups. Ignoring files with a size of fewer than 10 bytes, Wastedlocker encrypts victims files in batches of 64mb with the AES algorithm. The encrypted filenames are also renamed to include the victims name alongside the string wasted, i.e., file.doc.companynamewasted. The service also creates a separate ransom note which appears alongside each file, i.e., file.doc.companynamewasted_info.

After this process, the encryption service itself is deleted and a log file of encrypted files created. In return for unlocking the files, Evil Corp demands, through a specified email address, a ransom payable in Bitcoin. Most Evil Corp ransom demands range between $500,000 and $10 million.

The pathways that Evil Corp targets might not be immediately recognizable as significant assets. They often look for higher-value targets like file servers and database services alongside lower-value targets like virtual machines and physical workstations that could turn into high-value targets if used for lateral movement.

Evil Corp gains a foothold in these vulnerable endpoints by exploiting a critical weakness in many companies cybersecurity posture memory. Despite breached companies possessing EDR and AV security tools, EvilCorp has consistently demonstrated a capacity to bypass many advanced endpoint protection and antivirus methods with its full attack chain.

For organizations faced with highly sophisticated and targeted attacks from well-resourced cybercrime gangs like Evil Corp, standard AV and EDR platforms are of little use. While siloed backups can provide mitigation in case of a successful attack, targeted ransomware like WastedLocker usually aim to knock out backups as a key attack priority.

However, its still possible to protect corporate networks from these kinds of sophisticated attacks. A proactive cyber defense strategy prevents WastedLocker and other advanced ransomware attacks from progressing by preemptively detecting it and stopping its payload being delivered. With a dedicated memory defense layer, attacks never have a chance to infiltrate a targeted network in the first place. The Proactive Endpoint Protection solutions offered by Morphicsec protect corporate networks against zero-day and unknown attacks without needing any rules, signatures, or any other type of prior knowledge.

Read the original here:
Morphisec Knowledge Update: New WastedLocker Ransomware Causes Havoc Among Some of the Leading Enterprises in the U.S. - Security Boulevard