It’s a worrying trend that ransomware isn’t going away. Worse, it's constantly adapting to include brand new exploits/techniques and spreads in more innovative and successful ways.
Today, we are sharing an example of how previously known malware keeps evolving and adding new techniques to infect more systems.
BleepingComputer first reported on Satan ransomware in January 2017. Recently, Satan Ransomware was identified as using the EternalBlue exploit to spread across compromised environments.
This is the same exploit associated with a previous WannaCry Ransomware campaign. While Microsoft patched the vulnerability associated with EternalBlue in March 2017, many environments remain vulnerable.
IT security provider Alienvault identified samples of Satan Ransomware that not only include EternalBlue, but also a far larger set of propagation methods, variant attempts to propagate through:
- JBoss CVE-2017-12149
- Weblogic CVE-2017-10271
- EternalBlue exploit CVE-2017-0143
- Tomcat web application brute forcing
Here is their website with the technical details: https://www.alienvault.com/blogs/labs-research/satan-ransomware-spawns-new-methods-to-spread
How vulnerable is your network against ransomware infections?
Bad guys are constantly coming out with new versions of ransomware strains to evade detection. Is your network effective in blocking ransomware when employees fall for social engineering attacks?
KnowBe4’s Ransomware Simulator "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 10 ransomware infection scenarios and show you if a workstation is vulnerable to infection.
Here's how RanSim works:
100% harmless simulation of a real ransomware infection Does not use any of your own files Tests 10 types of infection scenarios Just download the install and run it Results in a few minutes!
Download RanSim Here:
https://www.knowbe4.com/ransomware-simulator
NOTE: Created for Windows-based workstations running Windows 7+. RanSim does not alter any existing files on disk. As part of the simulation RanSim does enumerate all files on the local disk(s). For the purposes of encryption, simulated data files are downloaded from the Internet.
