Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

‘Black Kingdom’ Ransomware Operators Target Pulse Secure VPNs

Researchers at Poland-based cybersecurity firm REDTEAM.PL have observed Black Kingdom ransomware attacks that exploit a Pulse Secure VPN vulnerability patched last year.

Researchers at Poland-based cybersecurity firm REDTEAM.PL have observed Black Kingdom ransomware attacks that exploit a Pulse Secure VPN vulnerability patched last year.

Tracked as CVE-2019-11510 and featuring a CVSS score of 10, the vulnerability was the most severe of several security flaws identified in enterprise VPNs from Pulse Secure.

An arbitrary file read issue, the bug could allow unauthenticated attackers to exfiltrate credentials that can then be used in combination with a remote command injection vulnerability in Pulse Secure products (CVE-2019-11539) to compromise private VPN networks.

Pulse Secure released patches for the identified issues in April 2019, and said in August 2019 that most customers had already installed them. However, it appears that some organizations still haven’t patched their systems.

In an alert published earlier this year, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that patching vulnerable VPNs would not be enough to keep attackers out, especially if they have already exploited the vulnerability.

The first cyberattacks targeting this vulnerability were observed in August last year, but the targeting has continued to date, with state-sponsored actors joining the fray since late 2019. In January, security researchers revealed that Sodinokibi ransomware operators started targeting the flaw.

Now, REDTEAM.PL says that the threat actor behind the Black Kingdom ransomware is also exploiting CVE-2019-11510 to compromise enterprise infrastructure.

Following initial compromise, the attackers use a scheduled task named GoogleUpdateTaskMachineUSA to achieve persistence. The task’s name closely resembles that of a legitimate Google Chrome task, which ends with UA, not USA.

The malicious task executes code to run a PowerShell script that downloads additional code from an IP address also used to launch network attacks. Once up and running on the compromised systems, the ransomware appends the .black_kingdom extension to the encrypted files.

In the ransom note dropped by the malware, the attackers demand $10,000 in Bitcoin, claiming they would destroy all of the victim’s data if the ransom isn’t paid within 600 minutes. The victim is instructed to contact the threat actor via the email address blackingdom at gszmail[.]com.

Related: Patching Pulse Secure VPN Not Enough to Keep Attackers Out, CISA Warns

Related: Pulse Secure VPN Vulnerability Still Widely Exploited, CISA Warns

Related: Pulse Secure VPN Vulnerability Exploited to Deliver Ransomware

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cybercrime

A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Ransomware

US government reminds the public that a reward of up to $10 million is offered for information on cybercriminals, including members of the Hive...

Ransomware

The Hive ransomware website has been seized as part of an operation that involved law enforcement in 10 countries.