{"id":5599,"date":"2019-05-01T22:48:57","date_gmt":"2019-05-01T21:48:57","guid":{"rendered":"https:\/\/www.n-able.com\/?p=5599"},"modified":"2021-04-06T22:53:28","modified_gmt":"2021-04-06T21:53:28","slug":"et-tu-admin-new-ransomware-attack-using-admin-accounts","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts","title":{"rendered":"Et Tu, Admin? A New Ransomware Attack Using Admin Accounts"},"content":{"rendered":"

A disturbing new trend in cyberattacks has started to become prevalent. Recently, a beverage manufacturer was hit by a ransomware virus; however, what\u2019s new here is it was remotely installed using an administrator account. While ransomware has traditionally been delivered by email, this could signal a new attack vector we need to protect against.<\/p>\n

This isn\u2019t an entirely new attack. The perpetrators used systems already on the machines to launch the attack. These are known as \u201cliving off the land\u201d attacks, which have become increasingly common. Doing this allows them to sneak past security controls by using pre-set, trusted components in a system. Attacks like these can be hard to defend against, but there are steps you can take to reduce your risk of a successful attack.<\/p>\n

Before I get into that, I want to walk you through the recent attack.<\/p>\n

The nitty gritty of the recent BitPaymer attack<\/h3>\n

Researchers at\u00a0Trend Micro<\/a>\u00a0found the attack started with a compromise on the system. They haven\u2019t specifically reported when or how that compromise occurred, but this initial compromise allowed the perpetrators to kick off the rest of the attack. Next, they used PowerShell Empire, an agent that can be used after exploiting a system, to tunnel into specific machines. From there, they compromised administrator accounts, and used them to install the BitPaymer ransomware using PsExec, a tool currently owned by Microsoftthat allows users to remotely execute processes on a machine.<\/p>\n

BitPaymer avoids detection using alternate data streams (ADS). ADS is a component of NTFS, the Windows NT file share system, and allows people to create a second data stream in a file that\u2019s usually hidden (although there are multiple tools for reading alternate data streams). Cybercriminals often use ADS to hide malware within legitimate files, making it hard for some security tools to detect.<\/p>\n

Protecting your customers<\/h3>\n

While this style of attack makes it challenging to detect the threat, there are steps you can take to help protect your customers.<\/p>\n

    \n
  1. Guard admin privileges with your life:\u00a0<\/b>Adhere to the \u201cprinciple of least privilege\u201d as much as you can. As an MSP, make sure to restrict admin privileges to a \u201cneed-to-use\u201d basis\u2014both within techs in your business and also on the customer end. This also applies to specific types of applications and services. You open your customers to risk if you run a service at the root level that doesn\u2019t need root access.<\/li>\n
  2. Treat admins as \u201ccrown jewels\u201d:\u00a0<\/b>I\u2019ve mentioned before that reducing your customers\u2019 cyberattack risks involves defining the business\u2019s most important resources and protecting them like the British government protects the crown jewels. Users with admin privileges are part of these crown jewels. For these users, you need to \u201cincrease the pain\u201d by placing additional safeguards around their accounts, such as requiring multifactor authentication, monitoring their actions, and ensuring they\u2019re using secure networks when working remotely (or requiring them to use a VPN). This allows you to focus your efforts on 20% of users while allowing you to conserve resources on the other 80%. Also, remove accounts once employees leave. Hackers can easily compromise admin accounts for employees who have left, especially if security rules weren\u2019t as stringent at the time.<\/li>\n
  3. Use a security monitoring tool:\u00a0<\/b>This attack could have been prevented (or at least mitigated) using some form of active security monitoring. For example, a cloud-based SIEM tool, like\u00a0SolarWinds\u00ae<\/sup>\u00a0Threat Monitor<\/a>, can help you detect anomalies in your environment before they wreak havoc. You may want to ramp up the monitoring profiles on admin users and investigate any strange actions. For example, if you notice multiple failed login attempts on an admin account, investigate whether it\u2019s from a legitimate user or malicious actors.<\/li>\n
  4. Leverage your RMM tool:\u00a0<\/b>Additionally, you should use an RMM tool like\u00a0SolarWinds RMM<\/a>\u00a0or\u00a0N‑central<\/a>\u00ae<\/sup>\u00a0to the fullest. You can set up checks in the system to alert you to unusual behavior. For example, you could set the system up to alert you if any unusual changes to administrator accounts occurs or if new admin accounts are created. If this change wasn\u2019t initiated by you or someone in your organization, you can take actions to remediate the issue. You could also consider adding checks on specific internal tools, like PowerShell.<\/li>\n<\/ol>\n

    Well-managed and secure<\/h3>\n

    I\u2019ve always said a well-managed environment is a secure environment. Keeping track of your admin accounts and implementing least privilege can help you mitigate the chances of a ransomware attack launching from a compromised admin account. And if you have monitoring in place, you can further reduce your risk.<\/p>\n

    These types of attacks won\u2019t go away\u2014in fact, they\u2019re only likely to increase. So make sure you\u2019re prepared by vigilantly managing your customers\u2019 environments.<\/p>\n","protected":false},"excerpt":{"rendered":"

    A disturbing new trend in cyberattacks has started to become prevalent. Recently, a beverage manufacturer was hit by a ransomware virus; however, what\u2019s new here is it was remotely installed…<\/p>\n","protected":false},"author":43,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-5599","post","type-post","status-publish","format-standard","hentry","topic-security"],"acf":[],"yoast_head":"\nEt Tu, Admin? A New Ransomware Attack Using Admin Accounts - N-able<\/title>\n<meta name=\"description\" content=\"There's a disturbing new trend in ransomware attacks... malware payloads being installed via administrators accounts and not being delivered via email. Tim Brown looks at this worrying new phenomenon.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Et Tu, Admin? A New Ransomware Attack Using Admin Accounts - N-able\" \/>\n<meta property=\"og:description\" content=\"There's a disturbing new trend in ransomware attacks... malware payloads being installed via administrators accounts and not being delivered via email. Tim Brown looks at this worrying new phenomenon.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts\" \/>\n<meta property=\"og:site_name\" content=\"N-able\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/NableMSP\" \/>\n<meta property=\"article:published_time\" content=\"2019-05-01T21:48:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-04-06T21:53:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/03\/share-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Tim Brown\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Nable\" \/>\n<meta name=\"twitter:site\" content=\"@Nable\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tim Brown\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minuti\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts\"},\"author\":{\"name\":\"Tim Brown\",\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/person\/65b11c76d7eceabc6a98f67feafee6e8\"},\"headline\":\"Et Tu, Admin? A New Ransomware Attack Using Admin Accounts\",\"datePublished\":\"2019-05-01T22:48:57+01:00\",\"dateModified\":\"2021-04-06T21:53:28+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts\"},\"wordCount\":807,\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#organization\"},\"articleSection\":[\"Security\"],\"inLanguage\":\"it-IT\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts\",\"url\":\"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts\",\"name\":\"Et Tu, Admin? A New Ransomware Attack Using Admin Accounts - N-able\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#website\"},\"datePublished\":\"2019-05-01T22:48:57+01:00\",\"dateModified\":\"2021-04-06T21:53:28+00:00\",\"description\":\"There's a disturbing new trend in ransomware attacks... malware payloads being installed via administrators accounts and not being delivered via email. Tim Brown looks at this worrying new phenomenon.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Security\",\"item\":\"https:\/\/www.n-able.com\/it\/blog\/category\/security\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Et Tu, Admin? A New Ransomware Attack Using Admin Accounts\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.n-able.com\/it\/#website\",\"url\":\"https:\/\/www.n-able.com\/it\/\",\"name\":\"N-able\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.n-able.com\/it\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.n-able.com\/it\/#organization\",\"name\":\"N-able\",\"url\":\"https:\/\/www.n-able.com\/it\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"width\":\"1024\",\"height\":\"1024\",\"caption\":\"N-able\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/NableMSP\",\"https:\/\/x.com\/Nable\",\"https:\/\/www.linkedin.com\/company\/n-able\",\"https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/person\/65b11c76d7eceabc6a98f67feafee6e8\",\"name\":\"Tim Brown\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/12fd73820610a5263c4429c2a99094e0c2e82401bbe39bf42457e891670b6566?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/12fd73820610a5263c4429c2a99094e0c2e82401bbe39bf42457e891670b6566?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/12fd73820610a5263c4429c2a99094e0c2e82401bbe39bf42457e891670b6566?s=96&d=mm&r=g\",\"caption\":\"Tim Brown\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Et Tu, Admin? A New Ransomware Attack Using Admin Accounts - N-able","description":"There's a disturbing new trend in ransomware attacks... malware payloads being installed via administrators accounts and not being delivered via email. Tim Brown looks at this worrying new phenomenon.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts","og_locale":"it_IT","og_type":"article","og_title":"Et Tu, Admin? A New Ransomware Attack Using Admin Accounts - N-able","og_description":"There's a disturbing new trend in ransomware attacks... malware payloads being installed via administrators accounts and not being delivered via email. Tim Brown looks at this worrying new phenomenon.","og_url":"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts","og_site_name":"N-able","article_publisher":"https:\/\/www.facebook.com\/NableMSP","article_published_time":"2019-05-01T21:48:57+00:00","article_modified_time":"2021-04-06T21:53:28+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/03\/share-image.jpg","type":"image\/jpeg"}],"author":"Tim Brown","twitter_card":"summary_large_image","twitter_creator":"@Nable","twitter_site":"@Nable","twitter_misc":{"Scritto da":"Tim Brown","Tempo di lettura stimato":"4 minuti"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts#article","isPartOf":{"@id":"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts"},"author":{"name":"Tim Brown","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/person\/65b11c76d7eceabc6a98f67feafee6e8"},"headline":"Et Tu, Admin? A New Ransomware Attack Using Admin Accounts","datePublished":"2019-05-01T22:48:57+01:00","dateModified":"2021-04-06T21:53:28+00:00","mainEntityOfPage":{"@id":"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts"},"wordCount":807,"publisher":{"@id":"https:\/\/www.n-able.com\/it\/#organization"},"articleSection":["Security"],"inLanguage":"it-IT"},{"@type":"WebPage","@id":"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts","url":"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts","name":"Et Tu, Admin? A New Ransomware Attack Using Admin Accounts - N-able","isPartOf":{"@id":"https:\/\/www.n-able.com\/it\/#website"},"datePublished":"2019-05-01T22:48:57+01:00","dateModified":"2021-04-06T21:53:28+00:00","description":"There's a disturbing new trend in ransomware attacks... malware payloads being installed via administrators accounts and not being delivered via email. Tim Brown looks at this worrying new phenomenon.","breadcrumb":{"@id":"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.n-able.com\/it\/blog\/et-tu-admin-new-ransomware-attack-using-admin-accounts#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Security","item":"https:\/\/www.n-able.com\/it\/blog\/category\/security"},{"@type":"ListItem","position":2,"name":"Et Tu, Admin? A New Ransomware Attack Using Admin Accounts"}]},{"@type":"WebSite","@id":"https:\/\/www.n-able.com\/it\/#website","url":"https:\/\/www.n-able.com\/it\/","name":"N-able","description":"","publisher":{"@id":"https:\/\/www.n-able.com\/it\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.n-able.com\/it\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/www.n-able.com\/it\/#organization","name":"N-able","url":"https:\/\/www.n-able.com\/it\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","width":"1024","height":"1024","caption":"N-able"},"image":{"@id":"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/NableMSP","https:\/\/x.com\/Nable","https:\/\/www.linkedin.com\/company\/n-able","https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw"]},{"@type":"Person","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/person\/65b11c76d7eceabc6a98f67feafee6e8","name":"Tim Brown","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/secure.gravatar.com\/avatar\/12fd73820610a5263c4429c2a99094e0c2e82401bbe39bf42457e891670b6566?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/12fd73820610a5263c4429c2a99094e0c2e82401bbe39bf42457e891670b6566?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/12fd73820610a5263c4429c2a99094e0c2e82401bbe39bf42457e891670b6566?s=96&d=mm&r=g","caption":"Tim Brown"}}]}},"_links":{"self":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts\/5599","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/users\/43"}],"replies":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/comments?post=5599"}],"version-history":[{"count":0,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts\/5599\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/media?parent=5599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}