Babuk Ransomware Seen Exploiting ProxyShell Vulnerabilities

A newly observed Babuk ransomware campaign is targeting ProxyShell vulnerabilities in Microsoft Exchange Server, according to security researchers at Cisco Talos.

The researchers spotted signs that the attackers are leveraging a China Chopper web shell for the initial compromise, and then use that for the deployment of Babuk.

Tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207, the issues were addressed in April and May, with technical details made public in August. An unauthenticated attacker can chain the bugs to for arbitrary code execution.

Attacks exploiting the security errors have been ongoing for the past several months, and Cisco’s researchers say that the Tortilla threat actor, which has been active since July 2021, has started targeting the Exchange Server flaws.

The employed infection chainfeatures an intermediate unpacking module that is downloaded from pastebin.pl (a pastebin.com clone) and then decoded in memory before the final payload is decrypted and executed.

[ READ: Microsoft Exchange Servers in Attacker Crosshairs ]

Cisco Talos found a modified EfsPotato exploit that targets both ProxyShell and PetitPotam vulnerabilities is employed for initial intrusion.

Once executed, the Babuk ransomware attempts to disable a series of processes on the victim server, to stop backup products, and also deletes volume shadow service (VSS) snapshots. Next, it encrypts all files on the server and appends the file extension .babyk to them.

The ransomware then deploys a ransom note demanding a $10,000 ransom payment from the victim in exchange for a decryption key.

Initially detailed in January 2021, Babuk has been targeting both Windows and Linux systems within enterprise environments, and uses a rather complex key generation mechanism to prevent file recovery. A free decryption tool for Babuk was released last week.

“Organizations should regularly update their servers and applications with the latest available patches from the vendors eliminating the vulnerabilities in their environment. Defenders should be constantly looking for suspicious events generated by detection systems for an abrupt service termination, abnormally high I/O rates for drives attached to their servers, the deletion of shadow copies or system configuration changes,” Cisco Talos said.

Related: Free Decryption Tools Available for Babuk, AtomSilo and LockFile Ransomware

Related: Microsoft Issues Guidance on ProxyShell Vulnerabilities

Related: Microsoft Exchange Servers in Attacker Crosshairs