Ransomware group caught using Microsoft-approved drivers to hack TechCrunch targets

[ad_1]

Security researchers say they have evidence that threat actors affiliated with the Cuba ransomware gang used Microsoft-certified malicious hardware drivers during a recent attempted ransomware attack.

Drivers, the software that allows operating systems and apps to access and communicate with hardware devices, require highly privileged access to the operating system and its data, which is why Windows requires drivers to bear an approved cryptographic signature before allow the driver to load.

These drivers have long been subject to abuse by cybercriminals, who often take a Bring Your Own Vulnerable Driver approach, where hackers exploit vulnerabilities found within an existing Windows driver from a legitimate software publisher. Sophos researchers say they have observed hackers making a concerted effort to gradually switch to using more widely trusted digital certificates.

While investigating suspicious activity on a network of customers, Sophos uncovered evidence that the Russia-linked Cuba ransomware gang is making efforts to trace the chain of trust. During their investigation, Sophos discovered that the gang’s older malicious drivers dating back to July were signed by certificates from Chinese companies, so they began signing their malicious driver with a leaked and then revoked Nvidia certificate found in the downloaded data from the gang. by Lapsus$ ransomware. when it hacked the chipmaker in March.

The attackers have now managed to obtain signage from Microsoft’s official Windows Hardware Developer Program, meaning that the malware is inherently trusted by any Windows system.

Threat actors are moving up the trust pyramid, attempting to use ever more reliable cryptographic keys to digitally sign their drivers, wrote Sophos researchers Andreas Klopsch and Andrew Brandt in a blog post. “Signatures from a large, reputable software publisher make it more likely that the driver will load into Windows unhindered, increasing the chances that Cuba ransomware attackers could terminate the security processes that protect their target computers.

Sophos discovered that the Cuba gang installed the malicious signed driver on a targeted system using a variant of the so-called BurntCigar loader, a well-known malware affiliated with the ransomware group that was first observed by Mandiant. The two are used in tandem in an attempt to disable endpoint detection security tools on targeted computers.

If successful which, in this case, were not the attackers could distribute the ransomware on the compromised systems.

Sophos, along with Mandiant and SentinelOne researchers, informed Microsoft in October that drivers certified by legitimate certificates were being used maliciously in post-exploitation activity. Microsoft’s investigation revealed that several developer accounts for the Microsoft Partner Center were busy submitting malicious drivers to obtain a Microsoft signature.

Ongoing analysis by the Microsoft Threat Intelligence Center indicates that signed malicious drivers were likely used to facilitate post-exploitation intrusion activities such as the distribution of ransomware, Microsoft said in an advisory published as part of its monthly scheduled patch release. security, known as Patch Tuesday. Microsoft said it has released Windows security updates that revoke the certificate for affected files and has suspended partner vendor accounts.

Earlier this month, a US government alert revealed that the Cuba ransomware gang brought in an additional $60 million from attacks against 100 organizations globally. The advisory warned that the ransomware group, which has been active since 2019, continues to target US entities in critical infrastructure, including financial services, government facilities, healthcare and public health, critical manufacturing and information technology.

[ad_2]