Hackers exploit social engineering, which avoids technical security systems, by manipulating the psychology and behavior of a human being.
Social engineering techniques, such as baiting emails or pretexting phone calls, manipulate victims into providing confidential information or performing actions that impede security details.
Attackers find it cheap and easy, as they need less specialist knowledge to make expensive use of trust, curiosity, or fear to trick their target.
Cybersecurity analysts at Rapid7 recently identified that threat actors have been actively exploiting a new social engineering attack that delivers Black Basta ransomware.
Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers
Technical Analysis
Rapid7 has uncovered multiple social engineering campaigns targeting several MDR clients.
Here, the spam emails flood the victims’ inboxes to make them accept remote access via tools such as AnyDesk or Quick Assist when someone pretending to be IT support calls them.
Once connected, the attacker downloads payloads to harvest credentials and maintain persistence, which could ultimately result in ransomware viruses, as in previous Black Basta operations.
This is a new take on things as it emerged towards the end of April 2024.
The attack begins by attacking affected users with a surge of seemingly harmless newsletter signup confirmation spam emails that bypass email protections.
Next, the attacker makes phone calls to people who are directly affected, and they pretend to be IT support in order to resolve this email issue.
Using social engineering, the hijacker persuades users to permit remote access through AnyDesk or Windows Quick Assist.
If one user does not succeed, the attacker immediately proceeds to the next targeted through spam campaigns.
Upon access acquisition, the infiltrator executes batch scripts that look like updates to make them appear genuine. The initial script tests C2 connectivity and downloads an OpenSSH for:-
- Windows zip file (renamed RuntimeBroker.exe)
- RSA keys
- Dependencies
- SSH config files
Registry run keys pointing to extra batch files ensure persistence. These scripts loop over SSH attempts at reverse shell connections to C2 using downloaded keys.
Some of these scripts have hard C2 coding, while others can be overridden through command-line functions. Other versions also achieve persisting via NetSupport or ScreenConnect functionalities.
In all the instances, the attacker utilized a batch script that seemed like an “update” to harvest the victims’ credentials through PowerShell, with most of them being exfiltrated immediately by means of SCP.
Aiming to move laterally, after being compromised initially, there were attempts to deploy Cobalt Strike beacons that consisted of DLL side-loading.
Although no data theft or ransomware was deployed, the indicators match previous Black Basta operations based on intelligence.
Mitigations
Here below, we have mentioned all the mitigations provided:-
- Make sure to block all the unapproved RMM tools.
- Block all the domains that are associated with unapproved RMM tools.
- Users should also be trained in social engineering.
- Ensure robust application allow-listing is enabled.
On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free