Microsoft warned today of ongoing human-operated ransomware campaigns targeting healthcare organizations and critical services, and shared tips on how to block new breaches by patching vulnerable internet-facing systems.
Many such attacks start with the human operators first exploiting vulnerabilities found in internet-facing network devices or by brute-forcing RDP servers and then deploying the ransomware payloads.
For instance, Pulse VPN devices have been
targeted by threat actors in the past, with one such vulnerable device thought to be
behind the Travelex ransomware attack by Sodinokibi (REvil).
Other ransomware gangs such as
DoppelPaymer and
Ragnarok Ransomware also exploited the
Citrix ADC (NetScaler) CVE-2019-1978 vulnerability to get a foothold on the edge of their victims' networks.
As Microsoft details, the final stage of deploying the ransomware and encrypting the systems is normally preceded by a reconnaissance stage where the attackers steal data they can later use for blackmail, as well as harvest credentials and move laterally throughout their victims' networks.
... ...