March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Lazarus APT Group – IOCs
March 4, 2022
Rewterz Threat Alert – Avaddon Ransomware – Active IOCs
March 7, 2022
Rewterz Threat Alert – Lazarus APT Group – IOCs
March 4, 2022
Rewterz Threat Alert – Avaddon Ransomware – Active IOCs
March 7, 2022
Severity
High
Analysis Summary
Conti ransomware was discovered in December 2019 and is delivered via TrickBot. It’s been utilized against large companies and government institutions across the world, especially in North America. Conti steals important files and information from targeted networks and threatens to disseminate it unless the ransom is paid. Conti ransomware enhances performance by utilizing “up to 32 simultaneous encryption operations,” and is very likely directly controlled by its controllers. This ransomware can target network-based resources while ignoring local files. This feature has the noticeable impact of being able to create targeted harm in an environment in a way that might hinder incident response actions.
Conti Ransomware is actively exploited the following vulnerabilities:
CVE-2021-1675
Microsoft Windows could allow a remote attacker to gain elevated privileges on the system, caused by a flaw in the Print Spooler component. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges.
Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Win32k component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.
Impact
- File Encryption
- Cyber Espionage
- Privilege Escalation
Affected Vendors
- Microsoft
Affected Products
- Microsoft Windows Server 2008 SP2 x32
- Microsoft Windows Server 2008 SP2 x64
- Microsoft Windows 7 SP1 x32
- Microsoft Windows 7 SP1 x64
Indicators of Compromise
CVE
- CVE-2021-1675
- CVE-2022-21882
Remediation
- Search for IOCs in your environment.
- Block all threat indicators at your respective controls
- According to the Security Researcher, here’s a method to check the CVE-2021-1675& CVE-2022-21882
For patches and security updates visit:
CVE-2021-1675
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2021-1675
CVE-2022-21882
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21882