Ryuk Ransomware Used in Attacks Abusing Windows MSHTML Bug
Working jointly with security RiskIQ, Microsoft security researchers announced that the recently detailed and patched vulnerability CVE-2021-40444 has been actively exploited by threat actors who later deployed the infamous Ryuk ransomware on compromised systems.
We already covered the CVE-2021-40444 vulnerability which was detailed in this month's regular Patch Tuesday session by Microsoft. The bug concerns a remote code execution vulnerability, triggered in the Windows MSHTML engine, when a victim opens a specially made, malware-laden Office file. The files need to contain a malicious ActiveX control to allow hackers to abuse the bug.
RiskIQ believes the attack is the work of cybercriminal outfit Wizard Spider. The infrastructure used in this latest malicious campaign targeting systems that till have no patches for CVE-2021-40444 was overlapping and showed similar patterns to infrastructure that Wizard Spider have used in the past in older campaigns using the Ryuk ransomware payload.
According to the researchers, the hackers only exploit the MSHTML bug as the first step, to gain foothold on a system. From this point on, they deploy Cobalt Strike beacon loaders which latch on to the remainder of what is likely Wizard Spider server infrastructure.
This new attack helped remind the infosec community that there are other ransomware gangs still out there, in addition to REvil and DarkSide group. For the past few months, all headlines related to ransomware attacks were always focused on the latter two threat actors, who in turn supposedly took a long vacation. Whether the Ryuk ransomware gang is trying to become more relevant again and fill in the space vacated by REvil and DarkSide remains to be seen.
The fact that the CVE-2021-40444 vulnerability is already proven to be exploited for attacks as dangerous as this shows how incredibly important is to keep networks and all devices connected to them patched with the latest updates from the publishers on the same day the new patch is out. The patch for the MSHTML vulnerability is already out and any further successful attacks abusing it should be completely avoidable.
