Sophos, a global leader in next-generation cybersecurity, today released findings on how attackers are using the Log4Shell vulnerability to deliver backdoors and profiling scripts to unpatched VMware Horizon servers, paving the way for persistent access and future ransomware attacks.
A new technical paper, “Horde of Miner Bots and Backdoors Leveraged Log4J to Attack VMware Horizon Servers,” details the tools and techniques used to compromise the servers and deliver three different backdoors and four cryptominers. The backdoors are possibly delivered by Initial Access Brokers.
Log4Shell is a remote code execution vulnerability in the Java logging component, Apache Log4J, which is embedded in hundreds of software products. It was reported and patched in December 2021.
“Widely used applications such as VMware Horizon that are exposed to the internet and need to be manually updated, are particularly vulnerable to exploitation at scale,” said Sean Gallagher, senior security researcher at Sophos. “Sophos detections reveal waves of attacks targeting Horizon servers, starting in January, and delivering a range of backdoors and cryptominers to unpatched servers, as well as scripts to collect some device information. Sophos believes that some of the backdoors may be delivered by Initial Access Brokers looking to secure persistent remote access to a high value target that they can sell on to other attackers, such as ransomware operators.”
The multiple attack payloads Sophos detected using Log4Shell to target vulnerable Horizon servers include:
- Two legitimate remote monitoring and management tools, Atera agent and Splashtop Streamer, likely intended for malicious use as backdoors
- The malicious Sliver backdoor
- The cryptominers z0Miner, JavaX miner, Jin and Mimu
- Several PowerShell-based reverse shells that collect device and backup information
Sophos’ analysis revealed that Sliver is sometimes delivered together with Atera and PowerShell profiling scripts and is used to deliver the Jin and Mimu variants of the XMrig Monero miner botnet.
According to Sophos, the attackers are using several different approaches to infect targets. While some of the earlier attacks used Cobalt Strike to stage and execute the cryptominer payloads, the largest wave of attacks that began in mid-January 2022, executed the cryptominer installer script directly from the Apache Tomcat component of the VMware Horizon server. This wave of attacks is ongoing.
“Sophos’ findings suggest that multiple adversaries are implementing these attacks, so the most important protective step is to upgrade all devices and applications that include Log4J with the patched version of the software. This includes patched versions of VMware Horizon if organizations use the application in their network,” said Gallagher. “Log4J is installed in hundreds of software products and many organizations may be unaware of the vulnerability lurking within their infrastructure, particularly in commercial, open-source or custom software that doesn’t have regular security support. And while patching is vital, it won’t be enough if attackers have already been able to install a web shell or backdoor in the network. Defense in depth and acting upon any detection of miners and other anomalous activity is critical to avoid falling victim to such attacks.”
For further information read the article “Horde of Miner Bots and Backdoors Leveraged Log4J to Attack VMware Horizon Servers” on Sophos News.
Sophos has closely monitored attack activity related to the Log4Shell vulnerability and has published a number of in depth technical and advisory reports, including Log4Shell Hell – Anatomy of an Exploit Outbreak, Log4Shell Response and Mitigation Recommendations, Inside the Code: How the Log4Shell Exploit Works, and Log4Shell: No Mass Abuse, But No Respite, What Happened?
71% of Nigerian Organizations Hit by Ransomware – Sophos’ Annual “State of Ransomware 2022”
Sophos report shows 44% of Nigerian Organizations that had Data Encrypted in a Ransomware Attack Paid the Ransom
The report shows that 71% of Nigerian organizations surveyed were hit with ransomware in 2021, up from 22% in 2020. Forty-four percent of the organizations that had data encrypted paid the ransom to get their data back, even if they had other means of data recovery, such as backups.
The report summarizes the impact of ransomware on 5,600 mid-sized organizations in 31 countries across Europe, the Americas, Asia-Pacific and Central Asia, the Middle East, and Africa.
“The survey shows that, globally, the proportion of victims paying the ransom continues to increase, even when they may have other options available,” said Chester Wisniewski, principal research scientist at Sophos. “There could be several reasons for this, including incomplete backups or the desire to prevent stolen data from appearing on a public leak site. In the aftermath of a ransomware attack there is often intense pressure to get back up and running as soon as possible”.
Continuing, Wisniewski said, “Restoring encrypted data using backups can be a difficult and time-consuming process, so it can be tempting to think that paying a ransom for a decryption key is a faster option. It’s also an option fraught with risk. Organizations don’t know what the attackers might have done, such as adding backdoors, copying passwords and more. If organizations don’t thoroughly clean up the recovered data, they’ll end up with all that potentially toxic material in their network and potentially exposed to a repeat attack.”
The main findings of the State of Ransomware 2022 global survey from the Nigerian respondents, which covers ransomware incidents experienced during 2021, as well as related cyber insurance issues, include:
- More victims are paying the ransom – In 2021, 44% of organizations that had data encrypted in a ransomware attack paid the ransom
- The impact of a ransomware attack can be immense –The average cost to recover from the most recent ransomware attack in 2021 was US$3.43 million. It took on average one month to recover from the damage and disruption. Ninety-seven percent of organizations said the attack had impacted their ability to operate, and 96% of the victims said they had lost business and/or revenue because of the attack
- Many organizations rely on cyber insurance to help them recover from a ransomware attack – 81% of mid-sized organizations had cyber insurance that covers them in the event of a ransomware attack – and, in 97% of incidents, the insurer paid some or all the costs incurred
- Ninety-one percent of those with cyber insurance said that their experience of getting it has changed over the last 12 months, with higher demands for cybersecurity measures, more complex or expensive policies and fewer organizations offering insurance protection
“The findings suggest we may have reached a peak in the evolutionary journey of ransomware, where attackers’ greed for ever higher ransom payments is colliding head on with a hardening of the cyber insurance market as insurers increasingly seek to reduce their ransomware risk and exposure,” said Wisniewski. “In recent years, it has become increasingly easy for cybercriminals to deploy ransomware, with almost everything available as-a-service. Second, many cyber insurance providers have covered a wide range of ransomware recovery costs, including the ransom, likely contributing to ever higher ransom demands. However, the results indicate that cyber insurance is getting tougher and in the future ransomware victims may become less willing or less able to pay sky high ransoms. Sadly, this is unlikely to reduce the overall risk of a ransomware attack. Ransomware attacks are not as resource intensive as some other, more hand-crafted cyberattacks, so any return is a return worth grabbing and cybercriminals will continue to go after the low hanging fruit.”
Sophos recommends the following best practices to help defend against ransomware and related cyberattacks
- Install and maintain high-quality defenses across all points in the organization’s environment. Review security controls regularly and make sure they continue to meet the organization’s needs
- Proactively hunt for threats to identify and stop adversaries before they can execute their attack – if the team lacks the time or skills to do this in house, outsource to a Managed Detection and Response (MDR) specialist
- Harden the IT environment by searching for and closing key security gaps: unpatched devices, unprotected machines, open RDP ports, etc. Extended Detection and Response (XDR) solutions are ideal for this purpose
- Prepare for the worst. Know what to do if a cyber incident occurs and keep the plan updated
- Make backups, and practice restoring from them so that the organization can get back up and running as soon as possible, with minimum disruption
Read The State of Ransomware 2022 report for the full global findings and data by sector.
OnePort 365 Secures $5 million Seed Funding To Digitize Freight Management In Africa
OnePort 365, a digital freight forwarding company that makes it easier to move cargo to, from and within Africa, has raised $5 million in seed funding to drive the end-to-end digitisation of freight management in Africa and support its expansion into new markets across the continent.
The seed funding round was led by Mobility 54 (the Venture Capital arm of Toyota Tsusho and CFAO Group), with participation from SBI Investment, Flexport, ODX, a Singaporean syndicate fund and other strategic angel investors. Samurai Incubate also re-invested after participating in the previous round.
With active operations in Nigeria and Ghana, and ongoing explorations in other markets, OnePort 365 is building an operating system for cross-border trade in Africa, helping traders to manage their freight processes through a digital platform that enables seamless freight forwarding and other value-added services.
With this new funding, OnePort 365 is positioned to further improve efficiency and lower overheads in cross-border trading across the continent, as well as deliver a wide range of new services that will increase profitability across the board.
Africa contributes an increasingly significant amount to global maritime trade, with a reported 12 percent of the 811 million containers handled at ports worldwide. Africa’s clearing and forwarding market is also growing, with latest figures suggesting a market size of $4.2 billion and a projected 12.5 percent growth with new services emerging.
However, a wide range of challenges including congestion at ports, difficulty with accessing effective service providers and complex payment systems have resulted in increased costs, inefficiencies and many missed opportunities for traders.
With OnePort 365, traders no longer have to wait up to two weeks to compare the best rates from different service providers. With pre-negotiated rates, they can explore competitive offers on the platform and book freights in 30 seconds or less.
Traders can also connect with shipping and inland transportation vendors and manage the entire process (from booking to payment) on one single platform. Traders get GPS-enabled, real-time visibility of their shipments and they can view all documents relating to the shipment via the platform, eliminating the laborious process of physically retrieving these documents from offices or shipping line centres.
The platform also leverages advancements in payment technology and the Pan-African Payment and Settlement System (PAPSS) to power instant payments.
The platform covers air freight, ocean freight, inland haulage (trucking, barge, and rail), as well as Pay-As-You-Go warehousing, marine insurance, customs brokerage and more. Since OnePort 365 started operations in 2019, it has increased the number of twenty-foot equivalent unit containers (TEUs) by 140 percent and grown its revenue by more than 420 percent.
Commenting on the new funding Hio Sola-Usidame, CEO and founder of OnePort 365 said “we are super excited to have these investors onboard to support our mission to optimize cross-border trading across the continent. With new regulations like the Africa Continental Free Trade Agreement creating the potential for a new era of trade on the continent, we want to make it easier for traders to maximise the opportunity. We believe managing freights should be as easy as booking a flight or ordering a ride-hailing service and we are building the operating system to make this possible.”
Takeshi Watanabe, CEO of Mobility 54 Investment SAS said “we are delighted to support Hio and the OnePort 365 team as they embark on the journey of digitizing the end-to-end freight management process in Africa. There is great potential to unlock significant commercial opportunities across the continent by addressing the longstanding challenges that have made it difficult to move freights into and around the continent, and we are confident that OnePort 365 has what it takes to succeed.”
Rena Yoneyama, Managing Partner at Samurai Incubate Africa said, “since the first day we joined the company as an investor in 2020, we’ve believed that this team is the one that could build a cross-border trading platform tailored for the African continent. We’re very happy to back OnePort 365 again”.
Billionaire Elon Musk Acquires Twitter At $44bn
Twitter on Monday confirmed it is selling the platform to billionaire entrepreneur Elon Musk in a deal valued at $44 billion.
The sale was a dramatic shift for the board, which had originally maneuvered to block Musk from taking the social media network private.
“Free speech is the bedrock of a functioning democracy, and Twitter is the digital town square where matters vital to the future of humanity are debated,” Musk said in a joint statement announcing the takeover.
Musk had taken a major stake in the firm earlier this month before lining up last week some $46.5 billion in financing to push forward with the purchase.
Twitter moves to block Elon Musk’s takeover
Twitter board chair Bret Taylor said the body “conducted a thoughtful and comprehensive process to assess Elon’s proposal with a deliberate focus on value, certainty, and financing,” according to the statement.
“The proposed transaction will deliver a substantial cash premium, and we believe it is the best path forward for Twitter’s stockholders.”
The polarizing Tesla chief’s campaign to buy the social media giant sparked concern that his unpredictable statements and alleged bullying are contradictory to his stated aims for the platform.