A new ransomware variant is being used in targeted attacks on managed service providers, technology, and healthcare firms, according to security researchers at Blackberry Cylance.

Attacks are being conducted on carefully selected, high profile targets using a new variant of VegaLocker/Buran ransomware named Zeppelin. VegaLocker has been around since early 2019 and all variants from this family have been used to attack companies in Russian speaking countries.

The campaigns were broad and used malvertising to direct users to websites hosting the ransomware. The latest variant is being used in a distinctly different campaign that is much more targeted. Attacks have only been detected on companies in Europe, the United States, and Canada so far. If the ransomware is downloaded onto a device in the Russian Federation, Ukraine, Belorussia, or Kazakhstan, the ransomware exits and does not encrypt files.

Ransomware variants from the VegaLocker family have all been offered as ransomware-as-a-service and there are indications that the same is true of Zeppelin ransomware, although the Blackberry Cylance researchers believe different threat actors are responsible for the attacks. There have only been a small number of attacks so far, so this could indicate a limited number of individuals are conducting attacks and targets are being selected carefully.

Zeppelin ransomware is highly customizable and can be deployed as an EXE or DLL file. Samples have also been found that are wrapped in PowerShell loaders. The ransom notes are also customizable and can be changed to suit different campaigns. Several have been detected that incorporate the name of the company being attacked, further demonstrating the highly targeted nature of the campaign.

Attacks have been conducted on multiple tech and health firms as well as managed service providers. Attacks on the latter see MSP files encrypted, and through their remote administration tools, the ransomware is deployed on the systems of their clients. Attacks on service providers are becoming far more common and several threat actors have adopted this tactic, including those behind Ryuk and Sodinokibi ransomware.

Zeppelin ransomware incorporates several layers of obfuscation to evade security solutions, including the use of encrypted strings, pseudo-random keys, and code of different sizes. The encryption routine can also be delayed avoid detection by heuristic analyses and fool sandboxes. The ransomware can also stop backup services and delete backup files and shadow copies to hamper recovery without paying the ransom.

After encryption the original file name and extension are retained. File tags are used that include the word Zeppelin. The encryption routine uses symmetric file encryption with randomly generated keys for each file, (AES-256 in CBC mode) along with asymmetric encryption for the session key, using a custom RSA implementation.

Some ransomware samples obtained by Blackberry Cylance researchers only encrypt the first 1000 bytes of a file. This is sufficient to render the files unusable but also speeds up the file encryption process so there is less chance of the attack being detected and stopped before file encryption has been completed.

As is common in these targeted attacks, a ransom note is dropped that provides email addresses for the victims to make contact with the attackers. This allows the attackers to set ransom payments on the perceived ability of the victim to pay.

It is unclear what methods are being used to distribute Zeppelin ransomware. The researchers have found a sample on water-holed websites, with the ransomware payload hosted on Pastebin but several distribution methods may be used.

Protecting against attacks requires a combination of security solutions and the adoption of cybersecurity best practices. Block open ports, change all default passwords, disable RDP if possible, use an advanced spam filtering solution, apply patches promptly, and keep operating systems and software up to date. Ensure staff are trained and are following security best practices and make sure backups are regularly created and tested to make sure file recovery is possible. It is also essential for one backup copy to be stored securely on a device that is not connected to the network.

The post MSPs and Healthcare Organizations Targeted with New Zeppelin Ransomware Variant appeared first on HIPAA Journal.

The U.S. Department of Homeland Security’s Homeland Security Systems Engineering and Development Institute (HSSEDI) has updated its list of the 25 most dangerous software vulnerabilities. This is the first time in the past 8 years that the list has been updated.

The Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Errors was first created in 2011. The list is an important tool for improving cybersecurity resiliency and is valuable to software developers, testers, customers, security researchers, and educators as it provides insights into the most prevalent and serious security threats in the software industry.

The list was originally compiled by analysts using a subjective approach for assessing vulnerabilities. Security researchers were interviewed, and industry experts were surveyed to find out which vulnerabilities were believed to be the most serious. HSSEDI, which is run by MITRE, used a different approach for assessing vulnerabilities: One that is based on real-world vulnerabilities that have been reported by security researchers.

“We shifted to a data-driven approach because it enables a more consistent and repeatable analysis that reflects the issues we are seeing in the real world,” explained CWE project leader Chris Levendis. “We will continue to mature the methodology as we move forward.”

25,000 common software vulnerabilities and exposures detailed in the National Vulnerability Database over the past two years were assessed and ranked. The new approach takes the prevalence of flaws, their severity, potential for harm, and the likelihood of the flaws being exploited into account. While many serious vulnerabilities exist, if their impact is low or they are very rarely exploited, they were excluded from the list.

Prior to the update, Improper Neutralization of Special Elements used in an SQL Command (SQL injection) topped the list, but in the revised version it has fallen to position 6. The change in position does not reflect a change in the severity of SQL injection, as it still has the highest severity score (9.129 out of 10). The overall score is 24.54 out of 10, due to other factors such as prevalence and frequency of exploitation.

Top position now goes to Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119), which has a score of 75.56 out of 100 and a severity score of 8.045 out of 10. This is where software performs operations on a memory buffer but can read or write to memory outside of that memory buffer. That can allow operations to be performed on memory locations that are associated with other variables, data structures, or internal program data, which could lead to the remote execution of arbitrary code, alteration of information flow, or system crashes.

Second spot was taken by Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting – CWE-79). The vulnerability has a relatively low severity score (5.778 out of 10), but its overall score was 45.69 out of 100 due to the high probability of exploitation, its prevalence in reports, and exploitation allowing attackers to run unauthorized code.

Third spot went to Improper Input Validation (CWE-20), which has an overall score of 43.61 out of 100. The high score is due to the high probability of exploitation and potential for harm. This vulnerability has a severity score of 7.242 out of 10 and can be exploited to cause denial of service attacks, execution of unauthorized code, and allows reading and modification of memory.

The updated list can be viewed on the MITRE website.

The post DHS Updates Top 25 Most Dangerous Software Errors List for First Time in 8 Years appeared first on HIPAA Journal.