Darknet Discussions Highlight Linux Ransomware, Phishing, and Server Vulnerabilities
Summary
DarkOwl analysts describe darknet discussions around Linux-targeting ransomware, phishing via ads and SMS, and vulnerabilities in Microsoft Exchange and Atlassian Confluence, including continued interest in patched Confluence flaws.
Key points
- DarkOwl analysts report increased darknet discussion of ransomware targeting Linux systems and VMware ESXi environments; the article names LockBit and BlackBasta.
- Actors discuss phishing services and templates, including campaigns targeting corporate marketing accounts and malicious URLs promoted through Google ads.
- The article describes smishing that impersonates executives to confirm employee phone numbers and potentially deliver malware through a follow-up link.
- DarkOwl says Exchange vulnerabilities discussed by actors can enable remote code execution and other access, and that some attacks have exposed inboxes and attachments from on-premises servers.
- The article notes that Exchange vulnerabilities do not apply to Microsoft Online or Microsoft 365 cloud mail services, and cites Microsoft's advice to restrict remote PowerShell access for non-administrative users.
- Actors reportedly continue to explore the patched Confluence vulnerability CVE-2022-26134; the article also mentions interest in CVE-2022-26138 and claims of ransomware targeting vulnerable Confluence servers.
Article Details
- Event Type
- Darknet threat discussion and reporting on ransomware, phishing, smishing, and server vulnerabilities.
- Impact
- The article describes threats to Linux-based VMware ESXi servers, corporate accounts and networks, and Microsoft Exchange and Atlassian Confluence servers. Reported impacts include ransomware encryption, compromised credentials, remote code execution, privilege escalation, data theft, and creation of administrator accounts. It states that AvosLocker targeted vulnerable Confluence servers at scale.
CVE
Threat Actors
AvosLockerThe article reports that this ransomware gang targeted vulnerable Confluence servers with command and control at scale.BlackBastaDescribed as a ransomware gang that used SSH vulnerabilities and compromised credentials to deliver ransomware to servers.LockBitIdentified as a ransomware strain that specifically targeted virtual Linux-based VMware ESXi servers.
Malware
AvosLockeradministrator accounts created, and malicious access to corporate networks granted.The ransomware gang, AvosLocker targeted vulnerable Confluence servers with their command and control at scale earlier this summer.BlackBastaOther ransomware gangs like BlackBasta have followed suit using SSH vulnerabilities and compromised credentials to deliver the ransomware to the server.LockBitLockbit was one of the first ransomware strains to specifically target virtual Linux-based VMware ESXi servers, encrypting the vCenter infrastructure and virtual machines (VMs).
Vendors
Products
Confluence ServerAnother server vulnerability that is being discussed in darknet discussion forums is a remote code execution vulnerability that affects Confluence Server and Data Center (described as CVE-2022-26134 by the NVD).Microsoft 365 Apps for EnterpriseThese vulnerabilities do not apply to Microsoft Online or Microsoft 365 cloud mail services.Microsoft ExchangeServer Vulnerabilities – Microsoft ExchangeVMware ESXiLockbit was one of the first ransomware strains to specifically target virtual Linux-based VMware ESXi servers, encrypting the vCenter infrastructure and virtual machines (VMs).