Akira/Fog Ransomware Is Being Deploy to Unpatched Veeam Backup/Replication

Cybercriminals are exploiting a patched security flaw in Veeam Backup & Replication to deploy Akira and Fog ransomware, highlighting the ongoing threat posed by vulnerabilities even after they've been addressed. Cybersecurity firm Sophos has observed a recent spike in attacks leveraging compromised VPN credentials and the now-patched CVE-2024-40711, a critical vulnerability allowing unauthenticated remote code execution.

The attacks, detailed by Sophos, highlight a concerning trend of exploiting unpatched vulnerabilities and compromised VPNs to gain access to sensitive systems. The exploited flaw, CVE-2024-40711, was discovered and reported by security researcher Florian Hauser of CODE WHITE and was addressed by Veeam in early September 2024. However, the attackers are using it to create local accounts, gain administrator privileges, and deploy ransomware.

Sophos has observed a pattern in the attacks, with threat actors exploiting vulnerable Veeam instances running on port 8000, triggering the Veeam.Backup.MountService.exe to create a local account named 'point' and grant it administrator privileges. These privileges are then used to deploy ransomware or exfiltrate data.

The Fog ransomware deployment, for instance, involved dropping the ransomware on an unprotected Hyper-V server and using the rclone utility to exfiltrate data. While other ransomware deployments were unsuccessful, the active exploitation of CVE-2024-40711 underlines the critical importance of keeping systems patched and implementing robust security measures, including multifactor authentication for VPN access.

The NHS England has also issued an advisory regarding the threat, emphasizing that enterprise backup and disaster recovery applications are prime targets for cyberattacks. The use of compromised VPNs and unpatched vulnerabilities in these attacks highlights the importance of a multi-layered security approach that includes regular patching, strong password practices, and multifactor authentication.

The emergence of Lynx ransomware, a successor to INC ransomware, further emphasizes the dynamic nature of the ransomware threat landscape. Lynx, active since July 2024, has been observed targeting organizations in various sectors, including retail, real estate, architecture, finance, and environmental services in the U.S. and U.K. The ransomware's emergence is attributed to the sale of INC ransomware's source code on criminal underground markets, highlighting the ease with which ransomware variants can be created and distributed.

The U.S. Department of Health and Human Services (HHS) Health Sector Cybersecurity Coordination Center (HC3) has also issued an advisory regarding Trinity ransomware, a relatively new ransomware player believed to be a rebrand of 2023Lock and Venus ransomware. Trinity ransomware employs a double extortion strategy, targeting victims with both data encryption and threat of data disclosure. This strategy adds another layer of complexity to the ransomware threat, making it even more challenging for organizations to mitigate its impact.

Adding to the diverse ransomware landscape, a financially motivated threat actor known as BabyLockerKZ has been observed deploying a variant of MedusaLocker ransomware. This variant, primarily targeting organizations in E.U. countries and South America, uses publicly known attack tools and living-off-the-land binaries (LoLBins) to facilitate credential theft and lateral movement within compromised networks. These tools are often wrappers around publicly available tools, providing streamlined attack capabilities with graphical or command-line interfaces.

The rise of ransomware variants and their continued exploitation of vulnerabilities underscores the importance of proactive cybersecurity measures. Organizations need to prioritize comprehensive security strategies that include robust vulnerability management, timely patching, multifactor authentication, and employee training.

Furthermore, organizations need to actively monitor their networks for suspicious activity, implement strong data backup and recovery plans, and consider investing in specialized ransomware detection and response solutions. By taking these steps, organizations can significantly reduce their risk of falling victim to ransomware attacks.

In conclusion, the ongoing exploitation of vulnerabilities, the rise of new ransomware variants, and the adoption of increasingly sophisticated attack techniques highlight the evolving nature of the cyber threat landscape. It is crucial for organizations to remain vigilant, stay informed about the latest threats, and implement robust security measures to protect their critical systems and data.