{"id":16416,"date":"2020-10-23T17:49:17","date_gmt":"2020-10-23T15:49:17","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=16416"},"modified":"2020-10-23T17:49:17","modified_gmt":"2020-10-23T15:49:17","slug":"franzsische-it-firma-sopra-steria-von-ryuk-ransomware-befallen-zerologon-ausgenutzt","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2020\/10\/23\/franzsische-it-firma-sopra-steria-von-ryuk-ransomware-befallen-zerologon-ausgenutzt\/","title":{"rendered":"French IT company Sopra Steria attacked by Ryuk ransomware, Zerologon exploited?"},"content":{"rendered":"

[German<\/a>]The French IT company Sopra Steria, to which, for example, large parts of the IT of the National Health System (NHS) in Great Britain have been transferred, has fallen victim to a Ryuk ransomware attack. If the information I have is correct, an Active Directory domain controller was taken over via the Zerologon vulnerability, allowing the ransomware to spread on the service provider's IT network. <\/p>\n

<\/p>\n

\"\"Sopra Steria<\/a> SA  is a European management and technology consultancy headquartered in Annecy, France, which was formed in September 2014 from the merger of the two companies Sopra Group SA and Groupe Steria SCA. The German subsidiary is based in Hamburg. The Sopra Steria Group is represented in 25 countries and has a total of 46,245 employees (as of the end of 2019). So this is a bigger player. <\/p>\n

Ryuk ransomware infection<\/h2>\n

As reported<\/a> by the French medium LeMagIT on October 21, 2020, the attack (presumably by the Ryuk ransomware) must have taken place in the night from October 20 to 21, 2020. The Register picked it up in this article<\/a> on October 22, 2020 and writes that the company refused to say what exactly happened. A report<\/a> only confirms the infestation.<\/p>\n

\n

A cyberattack has been detected on Sopra Steria's (Paris:SOP) IT network on the evening of 20th October. Security measures have been implemented in order to contain risks. The Group's teams are working hard for a return to normal as quickly as possible and every effort has been made to ensure business continuity.<\/p>\n<\/blockquote>\n

\n

Sopra Steria is in close contact with its customers and partners, as well as the competent authorities.<\/p>\n<\/blockquote>\n

Sopra Steria customers may be anything but enthusiastic about the incident, as it is likely that customer data was taken before encryption, and that data will eventually become public. <\/p>\n

Active Directory infrastructure compromised <\/h2>\n

According to information from The Register, there are indications that Sopra Steria's Active Directory infrastructure has been compromised. It is believed that attackers have succeeded in infiltrating the Ryuk malware and encrypting files. This is also reported by Bleeping Computer in this article<\/a>. In a follow-up article in today's issue, the French medium LeMagIT reports<\/a> that the attackers used Cobalt Strike<\/a> to find a vulnerability and distribute the ransomware.  <\/p>\n

\n

Cobalt Strike<\/a> is a software with flexible functions to simulate industrial espionage on your own network, to test defensive measures and to increase your own computer security. This includes attack reconnaissance, intrusion, establishing stable access with a solid operational base in the victim's network and subsequent data theft. <\/p>\n

Cobalt Strike can detect security vulnerabilities by using a Red Team, an independent group of programmers, as an adversary with little or no information about the system and its structure. A collection of attack tools is available, post-processing tools include a report generator.<\/p>\n<\/blockquote>\n

According to the French article, the distribution of the ransomware including encryption must be lightning fast. The extent of the attack is currently unclear, since Sopra Steria's IT security team, with the help of external cyber security experts, has only just begun work on determining the course and scope of the attack.  <\/p>\n

Did an attack succeed via Zerologon vulnerability?<\/h2>\n

In the meantime, the numerous customers of the IT company have probably been informed about the attack. There is probably a reference to the Ryuk ransomware and there are hints how the attack went down. LeMagIT quotes from the letter that \"the first malicious attacks occurred a few days ago,\" probably before the attack on October 20, 2020. The techniques used for penetration are also described: <\/p>\n

\n

Using PSexec for lateral movement in the network, using Cobalt Strike for lateral movement; using transfer bits to install the Ryuk ransomware (which only targets Windows hosts); using Windows Share (Share$) on domain controllers to store the list of IP addresses the ransomware targets.<\/p>\n<\/blockquote>\n

LeMagIT assumes that transfer bits refers to the Windows service BITS, the Background Intelligent Transfer Service. LeMagIT therefore questions whether the attackers used the Zerologon vulnerability to penetrate and place the malware.<\/p>\n

\n

I've warned several times about the Zerologon vulnerability (see links at the end of this article). The Zerologon vulnerability (CVE-2020-1472) is a Privilege Escalation vulnerability due to the insecure use of AES-CFB8 encryption for Netlogon sessions. The vulnerability allows the takeover of Active Directory Domain Controllers (DC) \u2013 even remotely, if reachable via network\/Internet \u2013 by unauthorized attackers. <\/p>\n<\/blockquote>\n

LeMagIT writes that the information provided by the security team of Sopra Steria does not address this issue. But the magazine quotes Alain Bouill\u00e9, general delegate of the club Experts in Information and Digital Security (Cesin). In an email to members, Bouill\u00e9 wrote that the infection with the Ryuk ransomware was caused by an AD controller compromised by the CVE-2020-1472 (Zerologon) vulnerability. The members of the club were urged to close this vulnerability as soon as possible. <\/p>\n

Similar articles:
<\/strong>Windows Server: Zerologon vulnerability (CVE-2020-1472) allows domain hijacking<\/a>
0patch fixes Zerologon (CVE-2020-1472) vulnerability in Windows Server 2008 R2<\/a>
CISA Warning: Patch your Windows Servers against CVE-2020-1472 (Zerologon)<\/a>
Windows Domain Controller suddenly generate EventID 5829 warnings (August 11, 2020)<\/a>
Windows 10 V1607: Update KB4571694 creates ID 5827 events, bricks MMC<\/a>
Zerologon Exploits are used in the wild, patching (Windows Server, Samba) recommended<\/a> <\/p>\n

Cruise provider Carnival confirms ransomware attack with data exfiltration<\/a>
Ransomware grounds French shipping company CMA CGM S.A.<\/a>
German Software AG victim of Cl0p ransomware, data leaked<\/a>
Cyber attack with ransomware on US hospital operator UHS<\/a>
Ransomware attack in German hospital ends deadly for a women \u2013 blame Shitrix vulnerability<\/a>
Ransomware infection at German Dussmann Group<\/a>
Garmin shutdown by WastedLocker ransomware attack<\/a>
AgeLocker Ransomware attacks QNAP NAS drives<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

[German]The French IT company Sopra Steria, to which, for example, large parts of the IT of the National Health System (NHS) in Great Britain have been transferred, has fallen victim to a Ryuk ransomware attack. If the information I have … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580],"tags":[243,69],"class_list":["post-16416","post","type-post","status-publish","format-standard","hentry","category-security","tag-ransomware","tag-security"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/16416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=16416"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/16416\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=16416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=16416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=16416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}