ProxyShell and PetitPotam exploits weaponized by LockFile Ransomware Group

For a detailed advisory, download the pdf file here.

LockFile, a new ransomware gang, has been active since last week. LockFile began by using a publicly disclosed PetitPotam exploit (CVE-2021-36942) to compromise Windows Domain Controllers earlier this week. Using ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207), they’ve now infiltrated many Microsoft Exchange Servers . The origins of this gang are most likely China. This gang used a similar ransomware note as of LokiBot and is been linked to Conti ransomware due to the email id provided (contact@contipauper[.]com). HivePro Threat Research team advises everyone to patch the vulnerabilities to prevent an attack.

Vulnerability Details

Actor Details

Indicators of Compromise (IoCs)

Patch Links

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34473

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34523

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36942

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31207

References

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows

https://www.bleepingcomputer.com/news/security/lockfile-ransomware-uses-petitpotam-attack-to-hijack-windows-domains/