Security News CryptON Ransomware Installed Using Hacked Remote Desktop Services

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/crypton-ransomware-installed-using-hacked-remote-desktop-services/

A new and active campaign for the CryptON Ransomware is currently underway where attackers are hacking into computers with Internet accessible Remote Desktop Services. Once the attackers gain access to the computer they manually execute the ransomware and encrypt your files.
This new campaign was first discovered by Malwarebytes security researcher S!Ri who posted about it on Twitter.
....
.....

It is not possible to decrypt the CryptON Ransomware Variant

Unfortunately, at this time there is no way to decrypt files encrypted by the CryptON Ransomware variant for free. Emsisoft does have a decryptor for older variants, but it does not work with the current version and it is unknown if a solution will be found.

The only way to recover encrypted files is via a backup, or if you are incredibly lucky, through Shadow Volume Copies. Though CryptON does attempt to remove Shadow Volume Copies, in rare cases ransomware infections fail to do so for whatever reason. Due to this, if you do not have a viable backup, I always suggest people try as a last resort to restore encrypted files from Shadow Volume Copies as well.

For those who wish to discuss this ransomware or need support, you can use our dedicated CryptON Ransomware Support & Help Topic.

 

[vtqhtr413]

I heard a snippet on the news about this today and the security expert in the segment suggested turning off remote desktop related windows services, what do you think LASER_oneXM?

 

[ForgottenSeer 58943]

This is of no consequence for home users and only IT using bad practices should have to worry.

For one, any version of Windows other than Pro doesn't even have RDP/RDS capability for remote connection. The option isn't even there as an option. Most importantly, even if you run Windows Pro, RDP isn't even reachable through the router without a port forward. Trust me on this, I punch through RDP PF's all day long on systems for terminal access.

If you are worried a super easy fix is to set your Remote Desktop listening port to something totally non-standard rather than 3389 default.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber

I dunno, make it 9929. Even though it's not exposed, if it was they'd have to find that port and assume you had RDP/RDS enabled, which you don't.

So really. This is of no concern at all and this is tremendous FUD. If you give anyone RDS/RDP access to your computer they don't need to manually execute ransomware, they can FORMAT your PC!

 

[LASER_oneXM]

I heard a snippet on the news about this today and the security expert in the segment suggested turning off remote desktop related windows services, what do you think LASER_oneXM?

i saw some articles/threads on the web about windows services and their risks. But on the other hand i also could find articles that warned users that disabling services (or making chages to services) could also be very, very risky to your system if you are not an experienced expert.