Hackers Exploit Unpatched VPNs to Install Ransomware on Industrial Targets

Unpatched Fortinet VPN devices are being targeted in a series of
attacks against industrial enterprises in Europe to deploy a new
strain of ransomware called “Cring” inside corporate networks.

At least one of the hacking incidents led to the temporary
shutdown of a production site, said cybersecurity firm Kaspersky in
a report published on Wednesday, without publicly naming the
victim.

The attacks happened in the first quarter of 2021, between
January and March.

“Various details of the attack indicate that the attackers had
carefully analyzed the infrastructure of the targeted organization
and prepared their own infrastructure and toolset based on the
information collected at the reconnaissance stage,” said^[1]
Vyacheslav Kopeytsev, a security researcher at Kaspersky ICS
CERT.

The disclosure comes days after the Federal Bureau of
Investigation (FBI) and the Cybersecurity and Infrastructure
Security Agency (CISA) warned^[2]
of advanced persistent threat (APT) actors actively scanning for
Fortinet SSL VPN appliances vulnerable to CVE-2018-13379, among
others.

“APT actors may use these vulnerabilities or other common
exploitation techniques to gain initial access to multiple
government, commercial, and technology services. Gaining initial
access pre-positions the APT actors to conduct future attacks,” the
agency said.

CVE-2018-13379^[3]
concerns a path traversal vulnerability in the FortiOS SSL VPN web
portal, which allows unauthenticated attackers to read arbitrary
system files, including the session file, which contains usernames
and passwords stored in plaintext.

Although patches for the vulnerability were released in May 2019^[4], Fortinet said last
November that it identified a “large number^[5]” of VPN appliances that
remained unpatched, while also cautioning that IP addresses of
those internet-facing vulnerable devices were being sold on the
dark web.

The attacks aimed at European businesses were no different,
according to Kaspersky’s incident response, which found that the
deployment of Cring ransomware involved exploitation of
CVE-2018-13379 to gain access to the target networks.

“Some time prior to the main phase of the operation, the
attackers performed test connections to the VPN Gateway, apparently
in order to make sure that the stolen user credentials for the VPN
were still valid,” Kaspersky researchers said.

Upon gaining access, the adversaries are said to have used the
Mimikatz utility to siphon account credentials of Windows users who
had previously logged in to the compromised system, then utilizing
them to break into the domain administrator account, move laterally
across the network, and eventually deploy the Cring ransomware on
each machine remotely using the Cobalt Strike framework.

Cring^[6], a nascent strain that
was first observed in January 2021 by telecom provider Swisscom,
encrypts specific files on the devices using strong encryption
algorithms after removing traces of all backup files and
terminating Microsoft Office and Oracle Database processes.
Following successful encryption, it drops a ransom note demanding
payment of two bitcoins.

What’s more, the threat actor was careful to hide their activity
by disguising the malicious PowerShell scripts under the name
“kaspersky” to evade detection and ensured that the server hosting
the ransomware payload only responded to requests coming in from
European countries.

“An analysis of the attackers’ activity demonstrates that, based
on the results of the reconnaissance performed on the attacked
organization’s network, they chose to encrypt those servers which
the attackers believed would cause the greatest damage to the
enterprise’s operations if lost,” Kopeytsev said^[7].