Lorenz ransomware gang plants backdoors to use months later


Level 73
Thread author
Honorary Member
Top Poster
Content Creator
Apr 24, 2016
Security researchers are warning that patching critical vulnerabilities allowing access to the network is insufficient to defend against ransomware attacks.

Some gangs are exploiting the flaws to plant a backdoor while the window of opportunity exists and may return long after the victim applied the necessary security updates.

One case is a Lorenz ransomware attack that reached completion months after the hackers gained access to the victim's network using an exploit for a critical bug in a telephony system.
The S-RM researchers say that the long inactivity time could suggest that the ransomware group purchased their access to the victim network from a broker.

Another theory is that the Lorenz gang is sufficiently organized to have a dedicated branch that obtains initial access and protects it against possible hijacking by other intruders.

S-RM researchers Tim Geschwindt and Ailsa Wood say that threat actors typically take full advantage of a new vulnerability and try to find and compromise as many unpatched systems on the internet only to return at a later time to continue the attack.

They “assess that Lorenz is actively returning to old backdoors, checking they still have access and using them to launch ransomware attacks.”

For this reason, the two researchers note that updating software to the latest version at the right time is still an important step in defending the network but in the case of critical vulnerabilities, companies should also check their environment for exploit attempts and possible intrusions.

Reviewing logs, looking for unauthorized access or behavior, and checking network monitoring data for unexpected traffic could reveal an intrusion that would survive a security update.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.