Security News > 2021 > April > New ransomware group uses SonicWall zero-day to breach networks
A financially motivated threat actor exploited a zero-day bug in SonicWall SMA 100 Series VPN appliances to deploy new ransomware known as FiveHands on the networks of North American and European targets.
The group, tracked by Mandiant threat analysts as UNC2447, exploited the CVE-2021-20016 SonicWall vulnerability to breach networks and deploy FiveHands ransomware payloads before patches were released in late February 2021.
Prior to deploying the ransomware payloads, UNC2447 was also observed using Cobalt Strike implants for gaining persistence and installing a SombRAT backdoor variant, a malware first spotted in the CostaRicto campaign coordinated by a group of mercenary hackers.
The FiveHands ransomware deployed in UNC2447 attacks was first observed in the wild during October 2020.
BleepingComputer reported earlier today on Whistler resort municipality being hit by a new ransomware operation using a very similar Tor site, but it's not clear if there are any links to the FiveHands ransomware operation.
"UNC2447 monetizes intrusions by extorting their victims first with FIVEHANDS ransomware followed by aggressively applying pressure through threats of media attention and offering victim data for sale on hacker forums," Mandiant added in a report published today.
News URL
Related news
- Live Ransomware Demo: See How Hackers Breach Networks and Demand a Ransom (source)
- UK fines software provider £3.07 million for 2022 ransomware breach (source)
- Retail giant Sam’s Club investigates Clop ransomware breach claims (source)
- Texas State Bar warns of data breach after INC ransomware claims attack (source)
- Port of Seattle says ransomware breach impacts 90,000 people (source)
- Food giant WK Kellogg discloses data breach linked to Clop ransomware (source)
- Microsoft: Windows CLFS zero-day exploited by ransomware gang (source)
- PipeMagic Trojan Exploits Windows Zero-Day Vulnerability to Deploy Ransomware (source)
- CentreStack RCE exploited as zero-day to breach file sharing servers (source)
- ⚡ THN Weekly Recap: iOS Zero-Days, 4Chan Breach, NTLM Exploits, WhatsApp Spyware & More (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-02-04 | CVE-2021-20016 | SQL Injection vulnerability in Sonicwall products A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. | 9.8 |