Two ransomware incidents highlight how attackers target security blind spots
By Barracuda Networks IT security teams are bombarded daily if not hourly with security alerts and events. They need to cut through the noise to piece together the puzzle of potential threats and anomalous or suspicious activity to decide whether they are looking at legitimate actions or intruders with malicious intent. What happens when one or more of the puzzle pieces are missing? Two different, real-life ransomware incidents targeting manufacturing companies and mitigated by Barracuda Managed XDR highlight what can happen to a company when their security cover is incomplete. Incident #1: A Play ransomware attack The security blind spots: compromised domain admin credentials, unprotected server not visible to security cover, the misuse of legitimate, commercially available IT tools At approximately 1:00 a.m. on a Tuesday night, attackers exploited the credentials for a domain admin account to breach an unprotected remote desktop server belonging to their target. The lack of security cover meant that the anomalous activity on the domain controller went unnoticed. The attackers then tried to establish persistence by installing a remote monitoring and management application on the unprotected server so that they could control their target from a distance. The attackers used commercially available tools to try to obtain a list of credentials and move laterally through the network. This activity brought them to the attention of security tools which promptly killed the malicious activity. The attackers then tried to disable and manipulate security measures and delete copies of files – a common precursor to the release of ransomware. This activity was also detected and blocked. At 3:20 a.m. the attackers tried to execute Play ransomware and encrypt several devices. By 3:23 a.m. this attempt was shut down when the targeted endpoints were isolated from the network. With full security cover the attack could have been neutralised […]
