Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
Recent APT attack was reported on an oil and gas company compromising a Windows machine via a vulnerable driver. ZeroCleare then pivoted to spread to other devices on the network – setting up the groundwork for a potentially destructive attack. Reconnaissance began months ago by scanning from various low-cost/free VPN providers and gaining access to one of the accounts that was later involved in the attack, as per the spokesperson. During the summer of 2019, the attackers then used a password spray from a system on the local network to gain access to additional accounts, install ASPX webshells and gain domain administration privileges.
These wiper attacks are seen more frequently in the Middle East. The ZeroCleare wiper is part of the final stage of the overall attack. It is designed to deploy two different ways adapted to 32-bit and 64-bit systems. The general flow of events on 64-bit machines includes using a vulnerable, signed driver and then exploiting it on the target device to allow ZeroCleare to bypass the Windows hardware abstraction layer and avoid some operating system safeguards that prevent unsigned drivers from running on 64-bit machines. Since ZeroCleare relies on the EldoS RawDisk driver, which is not a signed driver and would therefore not run by default, the attackers use an intermediary file named soy.exe to perform the workaround. They load a vulnerable but signed VBoxDrv driver which the DSE accepts and runs and then exploit it to load the unsigned driver, thereby avoiding DSE rejection of the EldoS driver. Once loaded, the vulnerable VBoxDrv driver is exploited to run shellcode on the kernel level.
Post-exploitation, the driver was used to load the unsigned EldoS driver and proceed to the disk wiping phase. The soy.exe sample uses the Turla Driver Loader (TDL) method to exploit the vulnerability in the VirtualBox driver and load and execute the shellcode.
Wiper attacks focus on destroying infrastructure and disrupting operations rather than on data exfiltration. These attacks have been on the rise in 2019, with IRIS observing a 200-percent increase in their telemetry over the past six months.
MD5
SHA-256
Source IP