{"id":7533,"date":"2021-06-30T20:19:41","date_gmt":"2021-07-01T03:19:41","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7533"},"modified":"2023-04-05T12:39:58","modified_gmt":"2023-04-05T19:39:58","slug":"darkside-ransomware-threat-associations-unearthed","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/darkside-ransomware-threat-associations-unearthed\/","title":{"rendered":"DarkSide Ransomware: Further Threat Associations Unearthed"},"content":{"rendered":"
\nDarkSide Ransomware has added two more CVEs to its arsenal alongside two additional APT group associations. Check out our analysis and patch these vulnerabilities before they strike again!<\/p>\n<\/blockquote>\n
Last month, DarkSide ransomware went down in history for causing the single largest disruption in gasoline supply in the United States. The attack was so crippling that fuel prices peaked, panic buying was induced, and almost 45% of the East Coast\u2019s fuel supply was cut off. It took a week of reconstruction, alongside the FBI’s interference and a $5M ransom<\/a> payment, to bring the supply back online. Subsequently, the FBI recovered<\/a> about half of the ransom paid after gaining access to the bitcoin account that was used in the transaction.<\/p>\n
More CVE Findings<\/h2>\n
In our previous blog<\/a>, we observed how the DarkSide ransomware group utilized two vulnerabilities, CVE-2019-5544 and CVE-2020-3992, to launch its attacks on the Colonial Pipeline. Since then, we have come across more interesting findings about this ransomware.<\/strong><\/p>\n
\nIt has come to light that two additional CVEs, CVE-2020-1472 and CVE-2021-20016,\u00a0are part of the DarkSide attack arsenal.<\/h4>\n<\/blockquote>\n
<\/p>\n
CVE-2021-20016<\/strong><\/p>\n
\n
- \n
CVE-2021-20016 is a new vulnerability identified earlier this year. It is assigned a CVSS V3 score of 9.8 and tagged as a critical flaw.<\/p>\n<\/li>\n
- \n
The vulnerability exists across six SonicWall Secure Mobile Access (SMA) products, which act as an access gateway for organizations to provide remote access to resources hosted on-prem, in cloud, and in hybrid data centers.<\/p>\n<\/li>\n
- \n
The SonicWall advisory has published workarounds<\/a> for this vulnerability.<\/p>\n<\/li>\n<\/ul>\n
CVE-2020-1472<\/strong><\/p>\n
\n
- \n
CVE-2020-1472, popularly known as the Zerologon vulnerability, is a critical 2020 CVE that has a CVSS V3 score of 10. It can be exploited to gain elevated access to resources.<\/p>\n<\/li>\n
- \n
CVE-2020-1472 is seen in 11 products spread across vendors Microsoft, Fedora project, openSUSE, Canonical, Synology, and Samba.<\/p>\n<\/li>\n
- \n
Security updates<\/a> are available for patching the vulnerability.<\/p>\n<\/li>\n
- \n
In our Ransomware Report 2020<\/a>, we noted that CVE-2020-1472 was also weaponized by the CryptoMix ransomware family, which is associated with five other ransomware groups.<\/p>\n<\/li>\n<\/ul>\n
\nTwo Advanced Persistent Threat (APT) groups, Carbanak and FIN7, are now additionally associated with DarkSide. This brings the total number of APT groups using DarkSide to five.<\/p>\n<\/blockquote>\n
Exposure<\/h2>\n
\n
- \n
From our exposure analysis using Shodan, we can see that 2,911 deployments of SonicWall SMA 200 firmware and 688 products with CVE-2020-1472 are currently in use, making them vulnerable to attacks.\u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/b><\/p>\n<\/li>\n<\/ul>\n
<\/p>\n
The DarkSide Attack Methodology<\/h2>\n
The threat actors have been identified using<\/a> the Tor browser, which creates a multi-hop proxy network. Messages are encrypted at multiple levels using onion routing, allowing for increased anonymity on the internet. The DarkSide ransomware group has also been observed deploying Cobalt Strike as its command and control weapon. Cobalt Strike is a collection of threat emulation tools that is seeing more and more adoption by malicious groups.<\/p>\n
According to the latest news reports, the Colonial Pipeline attack happened because of leaked credentials of a virtual private network (VPN) account<\/a>, through which employees remotely accessed the company\u2019s network. While we may not exactly know what VPN vulnerability led to the breach, a lesson learned is that it is important to ensure the safety of VPNs<\/a> and other applications we use. Securin has always emphasized and even warned about this in our Cyber Risk Series<\/a>.<\/p>\n
DarkSide Ransomware MITRE ATT&CK Mapping<\/h2>\n
The following tactics and techniques are in addition to the previously published<\/a> MITRE ATT&CK mapping details.<\/p>\n
<\/p>\n