LockBit ransomware affiliates have been caught distributing the malware (opens in new tab) via compromised Microsoft Exchange servers, multiple sources have confirmed.
The issue was first identified by South Korean cybersecurity company AhnLab. This past summer, two servers belonging to one of its customers were infected with LockBit 3.0. As per the report, the attackers first deployed web shell, then escalated privileges to Active Directory admin a week later, stole some 1.3 TB of data, and encrypted systems hosted on the network.
While the attack seems straightforward in theory, there are some disagreements over how the threat actors managed to gain access to the servers in the first place.
New zero-day?
AhnLab seems to believe a zero-day flaw was exploited: “Looking at the Microsoft Exchange Server vulnerability history, the remote code execution vulnerability was disclosed on December 16, 2021 (CVE-2022-21969), the privilege escalation vulnerability was disclosed in February 2022, and the most recent vulnerability was on June 27.”
“That is, among the vulnerabilities disclosed after May, there were no reports of vulnerabilities related to remote commands or file creation,” AhnLab claimed in its report.
“Therefore, considering that WebShell was created on July 21, it is expected that the attacker used an undisclosed zero-day vulnerability.”
Security Affairs spotted cybersecurity expert Kevin Beaumont weighing in on the discussion, saying a zero-day is an unlikely possibility:
“There’s a lot going on in this report about LockBit ransomware (opens in new tab), and I’m not convinced it’s a zero day (there’s no evidence in report), but one to keep an eye on,” he tweeted.
Another security researcher, Will Dormann, also stressed that the report doesn’t point to a new zero-day: “So far I’ve only skimmed a translated version of the page, but what evidence is provided that it’s a different vulnerability?” he added.
Via Security Affairs (opens in new tab)
