Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Babuk Ransomware Seen Exploiting ProxyShell Vulnerabilities

A newly observed Babuk ransomware campaign is targeting ProxyShell vulnerabilities in Microsoft Exchange Server, according to security researchers at Cisco Talos.

A newly observed Babuk ransomware campaign is targeting ProxyShell vulnerabilities in Microsoft Exchange Server, according to security researchers at Cisco Talos.

The researchers spotted signs that the attackers are leveraging a China Chopper web shell for the initial compromise, and then use that for the deployment of Babuk.

Tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207, the issues were addressed in April and May, with technical details made public in August. An unauthenticated attacker can chain the bugs to for arbitrary code execution.

Attacks exploiting the security errors have been ongoing for the past several months, and Cisco’s researchers say that the Tortilla threat actor, which has been active since July 2021, has started targeting the Exchange Server flaws.

The employed infection chainfeatures an intermediate unpacking module that is downloaded from pastebin.pl (a pastebin.com clone) and then decoded in memory before the final payload is decrypted and executed.

[ READ: Microsoft Exchange Servers in Attacker Crosshairs ]

Cisco Talos found a modified EfsPotato exploit that targets both ProxyShell and PetitPotam vulnerabilities is employed for initial intrusion.

Once executed, the Babuk ransomware attempts to disable a series of processes on the victim server, to stop backup products, and also deletes volume shadow service (VSS) snapshots. Next, it encrypts all files on the server and appends the file extension .babyk to them.

The ransomware then deploys a ransom note demanding a $10,000 ransom payment from the victim in exchange for a decryption key.

Initially detailed in January 2021, Babuk has been targeting both Windows and Linux systems within enterprise environments, and uses a rather complex key generation mechanism to prevent file recovery. A free decryption tool for Babuk was released last week.

“Organizations should regularly update their servers and applications with the latest available patches from the vendors eliminating the vulnerabilities in their environment. Defenders should be constantly looking for suspicious events generated by detection systems for an abrupt service termination, abnormally high I/O rates for drives attached to their servers, the deletion of shadow copies or system configuration changes,” Cisco Talos said.

Related: Free Decryption Tools Available for Babuk, AtomSilo and LockFile Ransomware

Related: Microsoft Issues Guidance on ProxyShell Vulnerabilities

Related: Microsoft Exchange Servers in Attacker Crosshairs

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Nation-State

The North Korean APT tracked as TA444 is either moonlighting from its previous primary purpose, expanding its attack repertoire, or is being impersonated by...

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.