The S-RM researchers say that the long inactivity time could suggest that the ransomware group purchased their access to the victim network from a broker.
Another theory is that the Lorenz gang is sufficiently organized to have a dedicated branch that obtains initial access and protects it against possible hijacking by other intruders.
S-RM researchers Tim Geschwindt and Ailsa Wood
say that threat actors typically take full advantage of a new vulnerability and try to find and compromise as many unpatched systems on the internet only to return at a later time to continue the attack.
They “assess that Lorenz is actively returning to old backdoors, checking they still have access and using them to launch ransomware attacks.”
For this reason, the two researchers note that updating software to the latest version at the right time is still an important step in defending the network but in the case of critical vulnerabilities, companies should also check their environment for exploit attempts and possible intrusions.
Reviewing logs, looking for unauthorized access or behavior, and checking network monitoring data for unexpected traffic could reveal an intrusion that would survive a security update.
