Darkside: The Ransomware that brought a US pipeline to a halt
Posted on 18th May, 2021 | By Sumeetha
As of today our research has associated 260 vulnerabilities to ransomware. Remediating and patching these vulnerabilities on priority could have averted the Colonial Pipeline attack.
On May 7, 2021 Colonial pipeline which supplies fuel to the US's east coast area went offline after it fell victim to DarkSide Ransomware. A ransom of 75 Bitcoins amounting to $5M was reportedly paid to the hackers. This attack demonstrates again the determined efforts of ransomware attackers to create maximum disruption by hitting critical sectors.
Vulnerabilities exploited by DarkSide
DarkSide operates as Ransomware-as-a-Service (RaaS) which provides an affiliate service to attackers who wish to purchase ransomware to target victims. Colonial Pipeline became a victim through two vulnerabilities and here is our analysis -
- CVE-2019-5544 is an Open source vulnerability that exists in VMware ESXi 6.5.0 and RedHat Linux.
- CVE-2020-3992 exists in VMware ESXi 6.7.0 - a hypervisor solution that allows multiple virtual machines to share the same hard drive storage.
- Both vulnerabilities have Remote Code Execution (RCE) capabilities that allow an attacker on the same network to send malicious service location protocol (SLP) requests to an ESXi device and take control of it.
- These vulnerabilities are rated critical with a CVSSv3 score of 9.8.
- The Common Weakness Enumeration (CWE) that introduced these vulnerabilities in the product are CWE-787 and CWE-416.
- They also feature in MITRE Top 25 as the most dangerous weaknesses
- These vulnerabilities were highlighted in our recent Ransomware Spotlight Report
- Our research also shows that both vulnerabilities are used by another Ransomware family, the RansomExx family.
It’s now known that DarkSide is being used by three APT groups which are currently uncategorized - UNC2628, UNC2659, and UNC2465. These uncategorized APTs are still under research and are yet to be mapped to existing threat groups.
Global Exposure Analysis
Our exposure analysis using Shodan indicates there are still 23,095 and 30,998 instances of VMware ESXi exposed to the Internet and may be vulnerable to these attacks if they are not patched.
Darkside MITRE ATT&CK Mapping
T1112 - Modify Registry
T1012 - Query Registry
T1082 - System Information Discovery
T1120 - Peripheral Device Discovery
T1005 - Data from Local System
T1486 - Data Encrypted for Impact
T1543.003 - Create or Modify System Process: Windows Service
T1490 - Inhibit System Recovery
T1553.004 - Subvert Trust Controls: Install Root Certificate
T1078 - Valid Accounts
As of May 17th, Darkside ransomware has shut down its Ransomware-as-a-Service affiliate program, bowing down to political pressure. Its servers have been seized and cryptocurrency account drained by unknown sources.
Can we prevent another disruptive Ransomware attack?
Yes! Organizations need to take a risk-based vulnerability management approach and get a ransomware assessment for their attack surface and ransomware exposure.
Our research shows that attackers are using 260 vulnerabilities to deploy ransomware out of which 132 are active exploits trending right now.
CSW’s path-breaking report - Ransomware Spotlight 2021 is powered by Vulnerability Intelligence (VI) - a knowledge base of vulnerabilities used by Ransomware, APT groups and Nation state actors. Enriched by CSW’s security researchers, this data is a single source of truth for all things ransomware providing additional context and appropriate remediation information to fix vulnerabilities. This database also powers the Ransomware Assessment that we offer organizations to proactively identify vulnerabilities that attackers target to mount a ransomware attack!
Ransomware is evolving in new ways and its use has become mainstream and now is offered as Ransomware as a Service. When we published our report in February 2021, vulnerabilities associated with ransomware was 223. This number increased to 260 (17%) during the first quarter of 2021. We are seeing an overall increase in the number of active exploits, ransomware families, CWEs, new products and vendors that are tied to ransomware.
Our recommendation to sectors like Energy, Power, Water and Healthcare would be to assess susceptibility to ransomware and take proactive measures to defend their attack surface from further crippling attacks.
Get a Ransomware Assessment and avoid paying millions of dollars as Ransom.