Darkside: The Ransomware that brought a US pipeline to a halt

{Updated on October 18, 2021}: On October 6, 2021, researchers noticed an unnamed gang using a novel method to attack VMware ESXi servers, using an uber-fast Python script-based ransomware. The ransomware attack took less than three hours from initial access to encryption, something previously unheard of. Though the Python ransomware is just 6KB in size, it can do quite a lot of damage. 

The use of a Linux variant ransomware on ESXi servers is nothing new. In July, REvil was noted for using a Linux variant to target the much-exploited ESXi vulnerabilities. That was quickly followed by HelloKitty and DarkSide ransomware. The BlackMatter ransomware group, an offspring of the DarkSide gang, was reportedly still using the Linux variant of the malware used by DarkSide to target ESXi servers. 

We, therefore, urge organizations to harden the security on their ESXi servers or other hypervisors to secure and limit the attack surface.

As of today our research has associated 260 vulnerabilities to ransomware. Remediating and patching these vulnerabilities on priority could have averted the Colonial Pipeline attack.

On May 7, 2021 Colonial pipeline which supplies fuel to the US's east coast area went offline after it fell victim to DarkSide Ransomware. A ransom of 75 Bitcoins amounting to $5M was reportedly paid to the hackers.  This attack demonstrates again the determined efforts of ransomware attackers to create maximum disruption by hitting critical sectors. 

Vulnerabilities exploited by DarkSide

DarkSide operates as Ransomware-as-a-Service (RaaS) which provides an affiliate service to attackers who wish to purchase ransomware to target victims. Colonial Pipeline became a victim through two vulnerabilities and here is our analysis -

• CVE-2019-5544  is an Open source vulnerability that exists in VMware ESXi 6.5.0 and RedHat Linux. 
• CVE-2020-3992 exists in VMware ESXi 6.7.0 - a hypervisor solution that allows multiple virtual machines to share the same hard drive storage. 
• Both vulnerabilities have Remote Code Execution (RCE) capabilities that allow an attacker on the same network to send malicious service location protocol (SLP) requests to an ESXi device and take control of it.
• These vulnerabilities are rated critical with a CVSSv3 score of 9.8.
• The Common Weakness Enumeration (CWE) that introduced these vulnerabilities in the product are CWE-787 and CWE-416. 
• They also feature in MITRE Top 25 as the most dangerous weaknesses 
• These vulnerabilities were highlighted in our recent Ransomware Spotlight Report 
• Our research also shows that both vulnerabilities are used by another Ransomware family, the RansomExx family.

• It’s now known that DarkSide is being used by three APT groups which are currently uncategorized - UNC2628, UNC2659, and UNC2465. These uncategorized APTs are still under research and are yet to be mapped to existing threat groups.

Patches for both the vulnerabilities (CVE-2019-5544 & CVE-2020-3992) have been available for months and yet they are not being remediated.

Global Exposure Analysis

Our exposure analysis using  Shodan indicates there are still 23,095 and 30,998 instances of VMware ESXi exposed to the Internet and may be vulnerable to these attacks  if they are not patched.

Darkside MITRE ATT&CK Mapping

As of May 17th, Darkside ransomware has shut down its Ransomware-as-a-Service affiliate program, bowing down to political pressure. Its servers have been seized and cryptocurrency account drained by unknown sources.

Can we prevent another disruptive Ransomware attack?

Yes! Organizations need to take a risk-based vulnerability management approach and get a ransomware assessment for their attack surface and ransomware exposure. 

Our research shows that attackers are using 260 vulnerabilities to deploy ransomware out of which 132 are active exploits trending right now.

CSW’s path-breaking report - Ransomware Spotlight 2021 is powered by Vulnerability Intelligence (VI) - a knowledge base of vulnerabilities used by Ransomware, APT groups and Nation state actors. Enriched by CSW’s security researchers, this data is a single source of truth for all things ransomware providing additional context and appropriate remediation information to fix vulnerabilities. This database also powers the Ransomware Assessment  that we offer organizations to proactively identify vulnerabilities that attackers target to mount a ransomware attack!

Ransomware is evolving in new ways and its use has become mainstream and now is offered as Ransomware as a Service. When we published our report in February 2021, vulnerabilities associated  with ransomware was 223. This number increased to 260 (17%) during the first quarter of 2021. We are seeing an overall increase in the number of active exploits, ransomware families, CWEs, new products and vendors that are tied to ransomware.

Our recommendation to sectors like Energy, Power, Water and Healthcare would be to assess susceptibility to ransomware and take proactive measures to defend their attack surface from further crippling attacks. 

Get a Ransomware Assessment and avoid paying millions of dollars as Ransom.

Never miss a patch or an update with CSW's Patch Watch Newsletter. Subscribe now!