CISA, FBI Issue Joint Alert on Increased Use of Conti Ransomware
The Cybersecurity and Infrastructure Security Agency and the FBI have issued a joint alert over the increasing prevalence of a certain ransomware-as-a-service model.
To mitigate the threat, the security agencies recommended steps such as adopting multi-factor authentication, implementing network segmentation and keeping operating systems and software up to date.
Conti’s deployers reportedly compromise networks through spearphishing campaigns, stolen or weak Remote Desktop Protocol credentials, phone calls, fake software, malware distribution networks and common vulnerabilities in external assets.
The malicious actors then use legitimate remote monitoring and management software and remote desktop software as backdoors to maintain their presence on the victim’s networks.
Security experts believe that the malware spreads by exploiting unpatched assets such as the 2017 Microsoft Windows Server Message Block 1.0 server vulnerabilities, the PrintNightmare vulnerability in Windows and the Zerologon vulnerability in Microsoft Active Directory Domain Controller systems.
Conti’s developers likely pay its users a wage instead of taking a cut of the illegal profits made by affiliate cyber actors, as is the case in a typical ransomware-as-a-service setup, CISA said.
In early June, CISA released guidance for the effective use of Mitre ATT&CK, which the government describes as a framework for assessing cybersecurity risks and prioritizing threats.
ATT&CK serves as a repository of adversary information that security analysts can access to understand the techniques used by malicious hackers, including perpetrators of ransomware attacks.
Tags: CISA Conti cybersecurity Cybersecurity and Infrastructure Security Agency FBI joint alert MITRE ATT&CK PrintNightmare ransomware ransomware-as-a-service