Rewterz Threat Alert – WannaCry Ransomware – Active IOCs
March 25, 2022Rewterz Threat Alert – Nanocore Rat – Active IOCs
March 26, 2022Rewterz Threat Alert – WannaCry Ransomware – Active IOCs
March 25, 2022Rewterz Threat Alert – Nanocore Rat – Active IOCs
March 26, 2022Severity
Medium
Analysis Summary
LAPSUS$ Ransomware is a new and emerging ransomware group that has successfully attacked major conglomerate. Like most ransomware groups, LAPSUS$ also infiltrates organizations with a phishing attack. From there on, they exploit vulnerabilities like privilege escalation to get hold of administrative rights and blatantly display their abilities. LAPSUS$ Threat group has also breached Okta.
Now, some members of the group have been arrested by the City of London Police due to their data breaches in Nvidia, Microsoft, Ubisoft, Samsung, and Okta. While the LAPSUS$ gang announced that some members are taking a vacation, the City of London Police said that it had arrested seven people aged 16 to 21 “in connection with an investigation into a hacking group” and that all of them are under investigation.
Impact
- Financial Theft
- Data Breach
Indicators of Compromise
IP
- 139[.]162[.]22[.]146
- 185[.]56[.]83[.]40
URL
- http[:]//lapsus-group[.]com/
Remediation
- Logging – Log your eCommerce environment’s network activity and web server activity.
- Passwords – Ensure that general security policies are employed including: implementing strong passwords, correct configurations, and proper administration security policies.
- Admin Access – limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
- WAF – Web defacement must be stopped at the web application level. Therefore, set up a Web Application Firewall with rules to block suspicious and malicious requests.
- Patch – Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
- Secure Coding – Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
- 2FA – Enable two-factor authentication.
- Antivirus – Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using a multi-layered protection is necessary to secure vulnerable assets