Huntress Highlights RMM Abuse, BYOVD and WebDAV as Key 2024 Threats
Summary
Huntress identifies RMM abuse, BYOVD and WebDAV abuse as notable 2024 threats, describing attack methods, reported increases and defensive steps including MFA, driver blocking and disabling unused WebDAV.
Key points
- Huntress reports a 214% increase since January in RMM tools used in cybersecurity incidents, and says attackers use stolen credentials, phishing and brute force to gain access.
- Attackers may install unauthorized RMM tools to maintain access; the article also cites continued exploitation attempts involving ScreenConnect CVE-2024-1709.
- Huntress says BYOVD activity quadrupled and that nearly one in four ransomware attacks it observed involved BYOVD-powered anti-EDR activity or privilege escalation.
- BYOVD abuses vulnerabilities in trusted, signed drivers to disable security tools or gain kernel-level privileges; recommended steps include enabling detection and applying Microsoft's driver block rules.
- Huntress reports a 183% increase since January in attacks using WebDAV to deliver malware, including through malicious LNK files.
- The article describes WebDAV use for malware delivery, lateral movement and data exfiltration, and recommends disabling the WebClient service when WebDAV is unnecessary.
Article Details
- Topic
- 2024 cybersecurity threats: RMM abuse, BYOVD attacks, and WebDAV abuse
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe article reports attackers using WebDAV to exfiltrate sensitive files and data to their own servers.T1068 · Exploitation for Privilege EscalationAttackers exploit vulnerable drivers to escalate privileges to kernel level.T1219 · Remote Access ToolsAttackers abuse remote monitoring and management software to gain and maintain remote access to systems.T1562.001 · Disable or Modify ToolsBYOVD attacks use vulnerable drivers to kill or disable EDR and other monitoring processes.
CVE
Threat Actors
CubaNamed as a group associated with widespread BYOVD attacks.GhostLockerNamed as a group associated with widespread BYOVD attacks.INCNamed as a group associated with widespread BYOVD attacks.KasseikaNamed as a group associated with widespread BYOVD attacks.MedusaNamed as a group associated with widespread BYOVD attacks.RansomHubNamed as a group associated with widespread BYOVD attacks.RhysidaNamed as a group associated with widespread BYOVD attacks.
Malware
BadRabbitDespite becoming more prevalent this year, this shady attack method has actually been part of the toolkit for malware families like Bumblebee, Cicada, BadRabbit, and DarkGate since late 2023.BumbleBeeDespite becoming more prevalent this year, this shady attack method has actually been part of the toolkit for malware families like Bumblebee, Cicada, BadRabbit, and DarkGate since late 2023.CicadaDespite becoming more prevalent this year, this shady attack method has actually been part of the toolkit for malware families like Bumblebee, Cicada, BadRabbit, and DarkGate since late 2023.DarkGateDespite becoming more prevalent this year, this shady attack method has actually been part of the toolkit for malware families like Bumblebee, Cicada, BadRabbit, and DarkGate since late 2023.
Products
AnyDeskBeyond ScreenConnect, platforms like AnyDesk, Atera, ZohoAssist, LogMeIn, and TeamViewer are popular targets for password theft and lateral movement within networks. Meanwhile, rogue installations of Ninja, Domotz,AteraBeyond ScreenConnect, platforms like AnyDesk, Atera, ZohoAssist, LogMeIn, and TeamViewer are popular targets for password theft and lateral movement within networks. Meanwhile, rogue installations of Ninja, Domotz,Auvikfor password theft and lateral movement within networks. Meanwhile, rogue installations of Ninja, Domotz, Auvik, Naverisk, and Kaseya VSA have also been reported as tools abused by attackers looking to cement theirDomotztargets for password theft and lateral movement within networks. Meanwhile, rogue installations of Ninja, Domotz, Auvik, Naverisk, and Kaseya VSA have also been reported as tools abused by attackers looking to cementKaseya VSAlateral movement within networks. Meanwhile, rogue installations of Ninja, Domotz, Auvik, Naverisk, and Kaseya VSA have also been reported as tools abused by attackers looking to cement their foothold in an environment.LogMeInBeyond ScreenConnect, platforms like AnyDesk, Atera, ZohoAssist, LogMeIn, and TeamViewer are popular targets for password theft and lateral movement within networks. Meanwhile, rogue installations of Ninja, Domotz,Naverisktheft and lateral movement within networks. Meanwhile, rogue installations of Ninja, Domotz, Auvik, Naverisk, and Kaseya VSA have also been reported as tools abused by attackers looking to cement their foothold inNinjatargets for password theft and lateral movement within networks. Meanwhile, rogue installations of Ninja, Domotz, Auvik, Naverisk, and Kaseya VSA have also been reported as tools abused by attackers looking toScreenConnectA standout example of RMM abuse is the ongoing exploitation attempts of ScreenConnect (CVE-2024-1709), a vulnerability discovered back in February. Threat actors actively use this exploit to compromise systems, and itTeamViewerBeyond ScreenConnect, platforms like AnyDesk, Atera, ZohoAssist, LogMeIn, and TeamViewer are popular targets for password theft and lateral movement within networks. Meanwhile, rogue installations of Ninja, Domotz,WebDAVWebDAV abuseZohoAssistBeyond ScreenConnect, platforms like AnyDesk, Atera, ZohoAssist, LogMeIn, and TeamViewer are popular targets for password theft and lateral movement within networks. Meanwhile, rogue installations of Ninja, Domotz,