Connect with us

Hi, what are you looking for?



‘Black Kingdom’ Ransomware Operators Target Pulse Secure VPNs

Researchers at Poland-based cybersecurity firm REDTEAM.PL have observed Black Kingdom ransomware attacks that exploit a Pulse Secure VPN vulnerability patched last year.

Researchers at Poland-based cybersecurity firm REDTEAM.PL have observed Black Kingdom ransomware attacks that exploit a Pulse Secure VPN vulnerability patched last year.

Tracked as CVE-2019-11510 and featuring a CVSS score of 10, the vulnerability was the most severe of several security flaws identified in enterprise VPNs from Pulse Secure.

An arbitrary file read issue, the bug could allow unauthenticated attackers to exfiltrate credentials that can then be used in combination with a remote command injection vulnerability in Pulse Secure products (CVE-2019-11539) to compromise private VPN networks.

Pulse Secure released patches for the identified issues in April 2019, and said in August 2019 that most customers had already installed them. However, it appears that some organizations still haven’t patched their systems.

In an alert published earlier this year, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that patching vulnerable VPNs would not be enough to keep attackers out, especially if they have already exploited the vulnerability.

The first cyberattacks targeting this vulnerability were observed in August last year, but the targeting has continued to date, with state-sponsored actors joining the fray since late 2019. In January, security researchers revealed that Sodinokibi ransomware operators started targeting the flaw.

Now, REDTEAM.PL says that the threat actor behind the Black Kingdom ransomware is also exploiting CVE-2019-11510 to compromise enterprise infrastructure.

Following initial compromise, the attackers use a scheduled task named GoogleUpdateTaskMachineUSA to achieve persistence. The task’s name closely resembles that of a legitimate Google Chrome task, which ends with UA, not USA.

Advertisement. Scroll to continue reading.

The malicious task executes code to run a PowerShell script that downloads additional code from an IP address also used to launch network attacks. Once up and running on the compromised systems, the ransomware appends the .black_kingdom extension to the encrypted files.

In the ransom note dropped by the malware, the attackers demand $10,000 in Bitcoin, claiming they would destroy all of the victim’s data if the ransom isn’t paid within 600 minutes. The victim is instructed to contact the threat actor via the email address blackingdom at gszmail[.]com.

Related: Patching Pulse Secure VPN Not Enough to Keep Attackers Out, CISA Warns

Related: Pulse Secure VPN Vulnerability Still Widely Exploited, CISA Warns

Related: Pulse Secure VPN Vulnerability Exploited to Deliver Ransomware

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...