Cyberscum target Microsoft SQL Server boxen – and some careless sysadmins were reinfected after cleaning it out
(2020/04/01)
- Reference: 1585767728
- News link: https://www.theregister.co.uk/2020/04/01/ms_sql_servers_vollgar_guardicore/
- Source link:
A malware gang is targeting Microsoft SQL servers with such precision that they're disabling rival gangs' software nasties in their quest to steal control of servers from their rightful owners.
Israeli infosec outfit Guardicore Labs [1]today dubbed the attack group Vollgar, saying it had been operating "under the radar for almost two years."
"The Vollgar attack chain also demonstrates the competitive nature of the attacker, who diligently and thoroughly kills other threat actors' processes," the firm said in a statement.
Lead researcher Ophir Harpaz said in a research report: "Overall, Vollgar attacks originated in more than 120 IP addresses, the vast majority of which are in China. These are most likely compromised machines, repurposed to scan and infect new victims."
Eyecatchingly, although the majority of infected machines were cleaned up by their owners to remove the malware, a fifth of those weren't cleansed of badness for up to a fortnight in some cases. Worse, around 10 per cent of the machines observed by Harpaz and her team were reinfected by Vollgar's operators – suggesting sysadmins may not be taking routine infosec hygiene as seriously as they perhaps ought to be.
Cryptomining, backdoors
Vollgar's two main attack methods are planting cryptominers to create virtual currency through stealing compute resources, and planting remote-access tools. Their main vector is good old fashioned brute-forcing of passwords to gain access to compromisable machines.
Once inside the target box, Vollgar's operatives create a series of admin users to give themselves a backdoor for later exploitation. Harpaz described the hackers' tactics as "noisy", observing that their command 'n' control servers were all hosted on an ASN registered to a Gmail account – a potential indicator that the ASN may not have been hosting entirely legitimate businesses.
Speculating that MS-SQL servers exposed to the internet with weak credentials might explain how the attackers gained illicit access to "2,000 – 3,000 database machines daily", Harpaz explained that heathcare, aviation, IT, telcos and higher education institutions appeared to be the hacking crew's main targets.
Guardicore Labs is also providing a free Powershell detection script aiding detection of Vollgar's tracks on infected machines, the outfit said. ®
[1] https://www.guardicore.com/2020/04/vollgar-ms-sql-servers-under-attack/
Israeli infosec outfit Guardicore Labs [1]today dubbed the attack group Vollgar, saying it had been operating "under the radar for almost two years."
"The Vollgar attack chain also demonstrates the competitive nature of the attacker, who diligently and thoroughly kills other threat actors' processes," the firm said in a statement.
Lead researcher Ophir Harpaz said in a research report: "Overall, Vollgar attacks originated in more than 120 IP addresses, the vast majority of which are in China. These are most likely compromised machines, repurposed to scan and infect new victims."
Eyecatchingly, although the majority of infected machines were cleaned up by their owners to remove the malware, a fifth of those weren't cleansed of badness for up to a fortnight in some cases. Worse, around 10 per cent of the machines observed by Harpaz and her team were reinfected by Vollgar's operators – suggesting sysadmins may not be taking routine infosec hygiene as seriously as they perhaps ought to be.
Cryptomining, backdoors
Vollgar's two main attack methods are planting cryptominers to create virtual currency through stealing compute resources, and planting remote-access tools. Their main vector is good old fashioned brute-forcing of passwords to gain access to compromisable machines.
Once inside the target box, Vollgar's operatives create a series of admin users to give themselves a backdoor for later exploitation. Harpaz described the hackers' tactics as "noisy", observing that their command 'n' control servers were all hosted on an ASN registered to a Gmail account – a potential indicator that the ASN may not have been hosting entirely legitimate businesses.
Speculating that MS-SQL servers exposed to the internet with weak credentials might explain how the attackers gained illicit access to "2,000 – 3,000 database machines daily", Harpaz explained that heathcare, aviation, IT, telcos and higher education institutions appeared to be the hacking crew's main targets.
Guardicore Labs is also providing a free Powershell detection script aiding detection of Vollgar's tracks on infected machines, the outfit said. ®
[1] https://www.guardicore.com/2020/04/vollgar-ms-sql-servers-under-attack/