companies that were dependent on the
casia
it management software suffered a supply
chain attack
last weekend that may have resulted in
people using this system
automatically executing ransomware so
while
everybody was grilling setting off some
fireworks and celebrating independence
day
hackers were able to compromise
thousands of systems all over the globe
now again this is a supply chain attack
so it's really the people
that are downstream the people that are
using the software
uh that are really suffering and right
now researchers believe that more than 1
000 companies
are affected by this out of the 40
000 or so companies that are known to
use casey's software
now an attack on an it management
software like this
it really does have the ability to
spread far and wide because these days
most small to medium-sized companies
they don't even really have
a fully staffed it department they might
have like one or two guys
that know a little bit like maybe they
have an a-plus certification
and they're the ones that will actually
set up the computers for new employees
or maybe they'll troubleshoot some very
basic tasks
but these days most companies that are
that size
are instead relying on management
service providers
so essentially they're using contractors
for the i.t
role but that contractor that is
having the it systems outsourced to them
is obviously
a pretty big target i mean just think
about it instead of compromising
one it system to take down one company
or maybe not even the entire company
maybe you just get one branch like one
location
uh where their offices are instead of
doing that
you could just compromise every company
in the world
that is using this particular it system
or at least most of them in this case
uh such is the way of the supply chain
attack
now luckily the scope of this attack
it's mostly limited to the cassia
vsa unified remote management platform
so we can see some of the features that
this tool has
monitor and manage everything all of
your traditional endpoints whether it's
servers desktops or laptops snmp
network devices and printers get
visibility of your entire it environment
with the vsa
network topology map very convenient but
if hackers compromise your system they
also get visibility of your entire
network
there's also some automation that we get
with this so it boosts your i.t
efficiency through automation and
seamless workflows
remotely manage endpoints to proactively
resolve issues
automate it processes and auto remediate
it
incidents or you can automatically
create it incidents if you're able to
successfully compromise the software not
only that but you can probably wipe logs
so that
your the it people that are supposed to
get notified about these incidents
don't so now you can seamlessly and
automatically hack companies all over
the world um here's one example
of a company that was compromised by it
so
the sweden coupe supermarket chain
apparently all of them were highly
dependent on this software and many had
to shut down
their operations for several days a few
of them
were able to open back up but they
couldn't actually use the cash registers
to
process credit cards uh i'm not sure
whether they were
able to use cash or not what i was
reading from different news articles
is that they had people basically had to
pay with their phone i guess use like
samsung pay or apple pay that's how they
were able to
sort of still conduct operations and get
around that but imagine all the poor
little old
ladies right they're probably not using
apple pay or samsung pay
so how are they able to get their cat
food or their yogurt or whatever it is
that old ladies buy
uh now one interesting thing about this
attack
um is that samples of the malware are
actually available to
be looked at um i don't know if we have
the actual source code
to the malware i'm not sure if that's
been made public but i do have
these two binaries here and let me just
go ahead and transform this
to a hexadecimal view so that it looks a
little bit
less crazy
okay there we go that should look better
uh so these two malware samples they
are pretty much the same
like we can you know just take a look at
the
hex right there's not a whole lot of
differences between the two except if we
go to the bottom
of this a471 so if we go
starting here you can see that there's a
whole bunch
of zeros basically so this is just
padding that's added to the file
typically the reason why somebody might
do this is to just try and make
the executable larger in size to bypass
antivirus systems
or to just make it look more legit like
there's kind of the old uh
meme of downloading like what is it some
lincoln park song off of kaza but it's
got a dot
exe extension and it's only like 300 kb
in size so yeah that's the whole reason
for adding
uh the padding to it another interesting
thing about this malware is
really kind of how it worked um so it
would
get side loaded by a legitimate copy of
microsoft defender antivirus
now granted it did have to be an
older version of ms defender or at least
it had to be
some version of ms defender that is
vulnerable to what's called a dll
search order hijack which basically just
means that
if you place a malicious dll
in the same directory where the windows
defender executable is then it's going
to go ahead
and load that dll first just because it
sees it first instead of
actually going and loading the real dll
from wherever it's located on your
system
now obviously you already need to have
access
to the file system in order to take
advantage of that kind of a
vulnerability
but that can still help with certain
things like bypassing
user account control to escalate
privileges
since the dll is being loaded by a
process that has
escalated privileges ms defender in this
case
you can also take advantage of this
defender vulnerability
to help with persistence in your malware
because what's always going to load when
you start up a windows machine
ms defender so the malicious dll is
going to load
as well the malware would also enable
network discovery on the system the
thing that lets
different windows machines talk to each
other on a network so
obviously that's so that it can spread
to other windows machines
uh throughout the network now you're
probably wondering
who is actually responsible uh for this
cyber attack
it's hard to be 100 sure uh
with any type of like remote cyber
attack but most of the resources
are pointing towards it being the hacker
group rival
that offers ransomware as a service so
uh this attack did use malware that
goes under the same name as the hacking
group
they also used a ransom note
similar to revels let me see if i can
find it here yeah so this is um
basically the type of just generic
uh you know pay us bitcoin blah blah
blah so that we can unlock
uh your systems and they even use the
same
onion domain so this is the same one
that rival has been using for several
years
where they're telling you to go to
actually pay that bitcoin so you can see
the same domain that's listed here in
the screenshot
this malware also contained another
function that's
common with revel which is a white list
function
to basically spare users that are using
a russian keyboard layout
so they don't really want to hack
russians i think that they're
i don't know if they're necessarily
trying to target u.s companies or u.s
providers mean obviously
uh when they targeted cassia they
affected international companies like
swedish
supermarkets but yeah generally they
don't want to affect
russian users uh with their malware
and again that's a tactic that's used by
rival so i think it's pretty safe to say
that
this is the same people that were also
behind the gbs
meatpacking attack and that attack on
jbs was pretty major
since that's the largest meat supplier
in the world and
rival was able to get them to pay 11
million dollars
to release the decryption key so that
they could unlock their data
but this supply chain attack has
affected
so many different companies that rival
initially decided to
handle things differently and they were
just sending ransoms
to each of those individual companies so
the ransom pretty much depends on how
big the company
is how many machines they have and
several other factors
they were asking for forty five thousand
dollars to decrypt one machine
and then five million to decrypt an
entire domain
but revel is now offering a global
decryption key to unlock the data
for every single machine around the
globe that was compromised by this
attack
for 70 million dollars uh initially but
then that was later discounted to
50 million dollars which is still the
largest ransom
ever requested by a hacker group which
makes sense since this is also one of
the biggest
ransomware attacks that have ever been
pulled off by a hacking group
but it's still unknown whether or not
rival has received the 50 million
in bitcoin so ransomware attacks are
only getting worse and you're probably
wondering at this point
how you can try to secure yourself from
it the only way
is to have good backups but not only do
you need to have good backups
you also need to have offline backups so
we saw with the remote drive wipes
uh of what was it the western digital my
passport or something like that
um leaving your only backups online can
be dangerous
not to mention that with these
ransomware attacks the hackers usually
penetrate the systems
weeks or months in advance to locking
the files
so that they can try to find all of the
servers that are connected
and compromise those two as well as
figure out how to shut down
any type of anti-virus systems that
might try to stop the ransomware attack
but if you have an off-site backup or
just a machine that's
air-gapped away from your other devices
you can restore from the backup that is
saved there
and avoid paying the cost of a private
jet
to unlock your data