{"id":48339,"date":"2022-03-18T18:38:55","date_gmt":"2022-03-18T10:38:55","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=48339"},"modified":"2022-03-18T18:38:58","modified_gmt":"2022-03-18T10:38:58","slug":"conti-gang-encrypts-karmas-extortion-notes-in-dual-ransomware-attack-sophos","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2022\/03\/18\/conti-gang-encrypts-karmas-extortion-notes-in-dual-ransomware-attack-sophos\/","title":{"rendered":"Conti gang encrypts Karma\u2019s extortion notes in dual ransomware attack \u2013 Sophos"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong><a href=\"http:\/\/www.sophos.com\/\">Sophos<\/a>, a global player in next-generation cybersecurity, released findings of a dual ransomware attack where extortion notes left by Karma ransomware operators were encrypted 24 hours later by Conti, another ransomware gang that was in the target\u2019s network at the same time. <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sophos details the dual attacks in the article, \u201c<a href=\"https:\/\/news.sophos.com\/en-us\/2022\/02\/28\/conti-and-karma-actors-attack-healthcare-provider-at-same-time-through-proxyshell-exploits\/\">Conti and Karma Actors Attack Healthcare Provider at Same Time Through ProxyShell Exploits<\/a>,\u201d explaining how both operators gained access to the network through an unpatched Microsoft Exchange Server, but then used different tactics to implement their attacks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cTo be hit by a dual ransomware attack is a nightmare scenario for any organization. Across the estimated timeline there was a period of around four days when the Conti and Karma attackers were simultaneously active in the target\u2019s network, moving around each other, downloading and running scripts, installing Cobalt Strike beacons, collecting and exfiltrating data, and more,\u201d said Sean Gallagher, senior threat researcher, Sophos. \u201cKarma deployed the final stage of its attack first, dropping an extortion notice on computers demanding a bitcoin payment in exchange for not publishing stolen data. Then Conti struck, encrypting the target\u2019s data in a more traditional ransomware attack. In a strange twist, the Conti ransomware encrypted Karma\u2019s extortion notes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cWe have seen several cases recently where ransomware affiliates, including <a href=\"https:\/\/news.sophos.com\/en-us\/2021\/09\/03\/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks\/\">affiliates of Conti<\/a>, used ProxyShell exploits to penetrate targets\u2019 networks. We have also seen examples of <a href=\"https:\/\/news.sophos.com\/en-us\/2021\/11\/18\/new-ransomware-actor-uses-password-protected-archives-to-bypass-encryption-protection\/\">multiple actors exploiting<\/a> the same vulnerability to gain access to a victim. However, very few of those cases involved two ransomware groups simultaneously attacking a target and it shows, literally, how crowded and competitive the ransomware landscape has become.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Dual Attack<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sophos believes that the first incident started on Aug. 10, 2021, when attackers, possibly Initial Access Brokers, used a ProxyShell exploit to gain access to the network and establish a foothold on the compromised server. The Sophos investigation showed that almost four months passed before Karma appeared on Nov. 30, 2021, and exfiltrated more than 52 gigabytes of data to the cloud.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On Dec. 3, 2021, three things happened:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>The Karma attackers dropped an extortion note on 20 computers, demanding a ransom and explaining that they did not encrypt the data because the target was a healthcare provider<\/li><li>Conti was quietly operating in the background also exfiltrating data<\/li><li>The target started onboarding Sophos\u2019 incident response team to help with Karma<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">While Sophos was onboarding, Conti deployed its ransomware on Dec. 4, 2021. Sophos subsequently tracked the start of the Conti attack to another ProxyShell exploit leveraged on Nov. 25, 2021.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cWhether the initial access broker sold access to two different ransomware affiliates, or whether the vulnerable Exchange server was just an unlucky target for multiple ransomware operators, the fact that a dual attack was possible is a powerful reminder to patch widely known, internet-facing vulnerabilities at the earliest opportunity,\u201d said Gallagher. \u201cDefense-in-depth is vital for identifying and blocking attackers at any stage of the attack chain, while proactive, human-led threat hunting should investigate all potentially suspicious behavior, such as unexpected remote access service logins or the use of legitimate tools outside the normal pattern, as these could be early warning signs of an imminent ransomware attack.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sophos endpoint products, such as <a href=\"https:\/\/www.sophos.com\/en-us\/products\/endpoint-antivirus.aspx?&amp;cmp=17464&amp;utm_campaign=GPD-2019-UKI-Google-PaidSearch-InterceptX-Brand-DG-17464&amp;utm_medium=cpc&amp;utm_content=B_InterceptX&amp;utm_term=intercept+x&amp;utm_source=google-search&amp;gclid=Cj0KCQiA962BBhCzARIsAIpWEL2jnCZxJ0JRb4Pvsp6laibzYad9KsKK1LgrPAdkJaxu1b_RZUXivYsaAiqtEALw_wcB\">Intercept X<\/a>, protect users by detecting the actions and behaviors of ransomware and other attacks, such as those described in this Sophos research.&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Sophos details the dual attacks in the article, \u201cConti and Karma Actors Attack Healthcare Provider at Same Time Through ProxyShell Exploits,\u201d explaining how both operators gained access to the network through an unpatched Microsoft Exchange Server, but then used different tactics to implement their attacks.<\/p>\n","protected":false},"author":6,"featured_media":48340,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[286,54,2103,206],"class_list":["post-48339","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","tag-it-security","tag-security","tag-security-breach","tag-sophos"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/48339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=48339"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/48339\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/48340"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=48339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=48339"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=48339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}