Researchers at Poland-based cybersecurity firm REDTEAM.PL have observed Black Kingdom ransomware attacks that exploit a Pulse Secure VPN vulnerability patched last year.
Tracked as CVE-2019-11510 and featuring a CVSS score of 10, the vulnerability was the most severe of several security flaws identified in enterprise VPNs from Pulse Secure.
An arbitrary file read issue, the bug could allow unauthenticated attackers to exfiltrate credentials that can then be used in combination with a remote command injection vulnerability in Pulse Secure products (CVE-2019-11539) to compromise private VPN networks.
Pulse Secure released patches for the identified issues in April 2019, and said in August 2019 that most customers had already installed them. However, it appears that some organizations still haven’t patched their systems.
In an alert published earlier this year, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that patching vulnerable VPNs would not be enough to keep attackers out, especially if they have already exploited the vulnerability.
The first cyberattacks targeting this vulnerability were observed in August last year, but the targeting has continued to date, with state-sponsored actors joining the fray since late 2019. In January, security researchers revealed that Sodinokibi ransomware operators started targeting the flaw.
Now, REDTEAM.PL says that the threat actor behind the Black Kingdom ransomware is also exploiting CVE-2019-11510 to compromise enterprise infrastructure.
Following initial compromise, the attackers use a scheduled task named GoogleUpdateTaskMachineUSA to achieve persistence. The task’s name closely resembles that of a legitimate Google Chrome task, which ends with UA, not USA.
The malicious task executes code to run a PowerShell script that downloads additional code from an IP address also used to launch network attacks. Once up and running on the compromised systems, the ransomware appends the .black_kingdom extension to the encrypted files.
In the ransom note dropped by the malware, the attackers demand $10,000 in Bitcoin, claiming they would destroy all of the victim’s data if the ransom isn’t paid within 600 minutes. The victim is instructed to contact the threat actor via the email address blackingdom at gszmail[.]com.
Related: Patching Pulse Secure VPN Not Enough to Keep Attackers Out, CISA Warns
Related: Pulse Secure VPN Vulnerability Still Widely Exploited, CISA Warns
Related: Pulse Secure VPN Vulnerability Exploited to Deliver Ransomware