Publicly uncovered Distant Desktop providers are being abused to deploy new ransomware onto goal endpoints, researchers are saying. 

A cybersecurity researcher going by the title linuxct not too long ago reached out to MalwareHunterTeam to try to be taught extra a few ransomware pressure they found known as Venus. 

The staff later discovered that the ransomware operators had been energetic since mid-August 2022, focusing on victims the world over by getting access to a company community by way of the Home windows Distant Desktop protocol, even when a company makes use of an uncommon port quantity for the service. 

Hiding behind a firewall

The easiest way to guard towards such assaults, researchers concluded, is to place these providers behind a firewall. What’s extra, Distant Desktop Providers shouldn’t be publicly uncovered, and would ideally be accessible solely by way of a Digital Personal Community (VPN).

As for Venus ransomware, the modus operandi is nothing out of the peculiar for this kind of malware. As soon as community mapping, endpoint identification, and different reconnaissance work is finished, the malware will kill 39 processes utilized by database servers and Workplace purposes. Occasion logs and shadow copy volumes would get deleted, Information Execution Prevention would get disabled, and all information could be encrypted to hold the .venus extension. 

Lastly, the ransomware would create a ransom observe, demanding fee in cryptocurrencies in change for the decryption key. Venus would normally demand fee in bitcoin, and the newest data factors to the group demanding 0.02 BTC, or roughly $380, for the decryption key. 

The top of the ransom observe holds a base64 encoded blob, which researchers imagine is most probably the encrypted decryption key, and new submissions are being uploaded to ID Ransomware every day,

Final 12 months, there was one other ransomware pressure utilizing the identical encrypted file extension, however researchers are usually not certain if it’s the identical ransomware variant or not. 

• Take a look at the very best endpoint safety (opens in new tab) providers round

By way of: BleepingComputer (opens in new tab)