New Threat Actor Leverages ProxyShell Exploit to Serve Ransomware

Description

FortiGuard Labs is aware of a report that a new threat actor, "Tortillas," is leveraging the ProxyShell exploit to deliver ransomware. Based on the traits, the ransomware served by tortillas appears to be a Babuk ransomware variant. ProxyShell consists of three Microsoft Exchange vulnerabilities (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207) used in a chain that enables the attacker to remotely run malicious code on the targeted system as a result. The security flaws were patched by Microsoft in April and May 2021.

Why is this Significant?

This is significant because a previously undocumented threat actor "tortillas" is now taking advantage of the Proxyshell exploit chain to deliver a ransomware. While Microsoft released a fix for all three vulnerabilities used in ProxyShell in April and May 2021, more and more threat actors have since adopted ProxyShell in their attacks. In late August of this year, Lockfile ransomware was delivered through the ProxyShell and PetitPotam vulnerabilities. In September, the Conti ransomware gang reportedly added ProxyShell to their modus operandi.

FortiGuard Labs previously released two Threat Signals associated with ProxyShell. See the Appendix for a link to "Vulnerable Microsoft Exchange Servers Actively Scanned for ProxyShell" and "Brand New LockFile Ransomware Distributed Through ProxyShell and PetitPotam."

What is the Ransomware that is Deployed by Tortillas in this Attack?

The deployed ransomware appears to be a Babuk ransomware variant based on traits. For example, this particular ransomware adds .babyk file extension, typical of Babuk ransomware, to the files it encrypts. FortiGuard Labs also observed that this malware shares similar mutexes to Babuk.

The Babuk variant also steals data as part of a double extortion tactic. Upon encrypting the files and stealing data from the compromised machine, the Babuk variant instructs the victim to pay US $10,000 worth of Monero cryptocurrency to the attacker's wallet address for file decryption and for not releasing the stolen data to the public.

What is the Tortillas Threat Actor?

Tortillas appears to be a new threat actor whose activities have not been previously documented. FortiGuard Labs will monitor the threat actor and provide updates if any significant activities are observed.

Has Microsoft Released a Patch for ProxyShell?

Yes. Microsoft released a patch for CVE-2021-31207 in May. While CVE-2021-34473 and CVE-2021-34523 were disclosed in July 2021, Microsoft released a patch in April 2021 without disclosing them.

What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage for the Babuk variant sample used in this attack:

MSIL/Agent.JBV!tr

FortiGuard Labs provide the following IPS coverage for this attack:

• MS.Exchange.Server.Autodiscover.Remote.Code.Execution
• MS.Exchange.MailboxExportRequest.Arbitrary.File.Write
• MS.Exchange.Server.Common.Access.Token.Privilege.Elevation

FortiEDR detects and blocks ProxyShell attacks out of the box without any prior knowledge or special configuration beforehand.

All known network IOC's related to this threat are blocked by the FortiGuard WebFiltering Client.

Appendix

Vulnerable Microsoft Exchange Servers Actively Scanned for ProxyShell (Fortinet)

Brand New LockFile Ransomware Distributed Through ProxyShell and PetitPotam (Fortinet)

CVE-2021-34473 (MITRE)

CVE-2021-34523 (MITRE)

CVE-2021-31207 (MITRE)

Tweet by TG Soft (Twitter)