Security News > 2020 > October > Ryuk Ransomware Gang Uses Zerologon Bug for Lightning-Fast Attack
The analysis of the attack revealed that after about four hours and 10 minutes, the Ryuk gang pivoted from the primary domain controller, using RDP to connect to backup servers.
For the final phase of the attack, the Ryuk operators first deployed their ransomware executable onto backup servers.
Ryuk is a highly active malware, responsible for a string of recent hits, including a high-profile attack that shut down Universal Health Services, a Fortune-500 owner of a nationwide network of hospitals.
"The threat actors finished their objective by executing the ransomware on the primary domain controller, and at the five-hour mark, the attack completed," researchers said.
The use of Zerologon made the cybrcriminals' efforts much easier, since the attack didn't need to be aimed at a high-privileged user who would likely have more security controls.
News URL
https://threatpost.com/ryuk-ransomware-gang-zerologon-lightning-attack/160286/
Related news
- US indicts 8Base ransomware operators for Phobos encryption attacks (source)
- RA World Ransomware Attack in South Asia Links to Chinese Espionage Toolset (source)
- Chinese espionage tools deployed in RA World ransomware attack (source)
- Lee Enterprises newspaper disruptions caused by ransomware attack (source)
- Southern Water says Black Basta ransomware attack cost £4.5M in expenses (source)
- Qilin ransomware claims attack at Lee Enterprises, leaks stolen data (source)
- Ransomware gangs exploit Paragon Partition Manager bug in BYOVD attacks (source)
- Hackers Exploit Paragon Partition Manager Driver Vulnerability in Ransomware Attacks (source)
- Hunters International ransomware claims attack on Tata Technologies (source)
- Toronto Zoo shares update on last year's ransomware attack (source)