- Google warns of ScatteredSpider’s advanced social engineering tactics
- The hackers gain privileged access and use it to deploy ransomware
- The group targets critical infrastructure, retail, airline, and other industries
The infamous ScatteredSpider ransomware group is using VMware instances to target critical infrastructure organizations in the US, researchers have warned.
Security researchers from Google Threat Intelligence Group (GITG) have found the criminals are targeting critical infrastructure firms, but also retail, airline, and insurance industries.
The campaign is described as “sophisticated and aggressive”, split into multiple phases that last no longer than a couple of hours, the experts warn.
On the hunt for vCSA
In the campaign, the hackers do not exploit any vulnerabilities, but instead go for “aggressive, creative, and particularly skilled” social engineering. They first reach out to their victim’s IT desk, impersonating an employee, and asking for a reset on the employee’s Active Directory account.
After gaining the initial foothold, they would scan the network to identify high-value targets, such as domain names, VMware vSphere admins, and other security departments that can grant them admin access into the virtual environment.
Then, they would reach out to IT again, this time posing as a more privileged user, again asking for a password reset – but for an account with higher privileges.
From there, they look to access the VMware vCenter Server Appliance (vCSA), a preconfigured Linux-based virtual machine that provides centralized management for VMware vSphere environments, including the ESXi hypervisor.
This, in turn, allows them to enable SSH connections on ESXi hosts, resetting root passwords.
From this point on, it is all about identifying and exfiltrating sensitive information, in preparation for the deployment of an encryptor. Locking down the entire network is the final stage of the attack, after which the victims are pressured into paying a ransom demand.
GTIG says that the entire attack happens quickly, going from initial access to ransomware deployment in “mere hours”, warning companies to tighten up on their security across the board, and to use phishing-resistant MFA.
Via BleepingComputer
