Windows Defender hacked to deploy this dangerous ransomware

Date:
Mon, 01 Aug 2022 16:01:42 +0000

Description:
With the help of log4shell, threat actors are deploying dangerous ransomware via Windows Defender.

FULL STORY ======================================================================

Log4j vulnerabilities are now being used to deploy Cobalt Strike beacons through the Windows Defender command line tool, researchers have found.

Cybersecurity researchers from Sentinel Labs recently spotted a new method, employed by an unknown threat actor, with the endgame being the deployment of LockBit 3.0 ransomware .

It works like this: the threat actor would leverage log4shell (as the Log4j zero-day is dubbed) to gain access to a target endpoint, and obtain the necessary user privileges. Once thats out of the way, theyd use PowerShell to download three separate files: a Windows CL utility file (clean), a DLL file (mpclient.dll), and a LOG file (the actual Cobalt Strike beacon).
Side-loading Cobalt Strike

They would then run MpCmdRun.exe, a command line utility that performs
various tasks for Microsoft Defender. That program would usually load a legitimate DLL file - mpclient.dll, which it needs to correctly run. But in this instance, the program would load a malicious DLL of the same name, downloaded together with the program.

That DLL will have the LOG file load and decrypt an encrypted Cobalt Strike payload.

It's a method known as side-loading. Read more

Microsoft SQL servers hit by Cobalt Strike attacks

Patched Cobalt Strike vulnerabilities could have dealt a crippling blow to

malicious users

Stay safe from cybercriminals with the best endpoint protection services

around

Usually, this LockBit affiliate used VMwares command line tools to side-load Cobalt Strike beacons, BleepingComputer says, so the switch to Windows Defender is somewhat unusual. The publication speculates the change was made to bypass targeted protections that VMware recently introduced. Still, using living-off-the-land tools to evade being detected by antivirus or malware protection services is extremely common these days, the publication
concludes, urging businesses to check their security controls and be vigilant with tracking how legitimate executables are being (ab)used.

Even though Cobalt Strike is a legitimate tool, used for penetration testing, its grown quite infamous as its being abused by threat actors everywhere. It comes with an extensive list of features that cybercriminals can use to map out the target network, undetected, and move laterally across endpoints, as they prepare to steal data and deploy ransomware. These are the best
firewalls right now

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/windows-defender-hacked-to-deploy-this-dangerou s-ransomware/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)