Shodan Images Reveal Ransomware Activity on Exposed VNC Systems
Summary
Huntress researchers used Shodan images to examine exposed, unauthenticated VNC systems, finding attempted GandCrab/REvil payload delivery using PowerShell, bitsadmin and FTP, plus a separate unidentified campaign.
Key points
- The researchers searched Shodan images for exposed VNC sessions showing commands such as PowerShell, bitsadmin, FTP and Nslookup.
- One example showed repeated attempts to deliver and execute ransomware on a pfSense router; the article does not report that the attempts succeeded.
- The article attributes the activity to GandCrab/REvil based partly on historical IP and executable-name searches, and describes a related campaign involving coin-mining activity.
- A separate, unidentified campaign checked VNC connectivity and made Nslookup requests involving vncport[.]hacked[.]com.
- The researchers recommend understanding the external attack surface, limiting exposed ports where possible, and adding security controls when exposure is necessary.
Article Details
- Attack Vectors
- Attackers used unauthenticated, internet-exposed VNC instances to send commands to connected devices.
- In the described GandCrab/REvil campaign, commands attempted to use cmd.exe to launch PowerShell, bitsadmin, and FTP to download payloads, followed by attempts to execute the ransomware.
- A separate, unidentified campaign checked connectivity to a VNC port and made Nslookup requests to external IPv4 addresses using the domain vncport.hacked.com.
- Defensive Notes
- Maintain visibility into the externally facing network and review the attack surface from an attacker’s perspective.
- Avoid exposing ports where possible; where exposure is necessary, add security layers to restrict or frustrate access.
- Apply basic cyber hygiene and security controls.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | vncport[.]hacked[.]com | Domain used by the unidentified campaign in Nslookup requests after checking VNC-port connectivity. |
| IPV4 | 92[.]63[.]197[.]153 | IP address that the article says is associated with the GandCrab/REvil ransomware campaign. |
MITRE ATT&CK
T1046 · Network Service DiscoveryThe unidentified campaign checked whether it could connect to a VNC port.T1059.001 · PowerShellThe campaign attempted to launch PowerShell through cmd.exe to download payloads.T1059.003 · Windows Command ShellThe article describes cmd.exe being used to launch PowerShell, bitsadmin, and FTP commands.T1059.004 · Unix ShellThe campaign attempted to launch FTP through cmd.exe.T1105 · Ingress Tool TransferPowerShell, bitsadmin, and FTP were used in attempts to download first-stage payloads.T1197 · BITS JobsThe campaign attempted to use bitsadmin to download payloads.
People
Threat Actors
Malware
Products
pfSenseBelow I have taken an instance where the ransomware group tried to infect a pfSense router with PowerShell, bitsadmin and FTP, and not only was that not enough, but they did it again.ShodanHomeBlogUsing Shodan Images to Hunt Down Ransomware GroupsVNCBelow you can see there are 10,000 exposed instances of virtual network computing (VNC) with no authentication, and to a threat actor, that's 10,000 potential paydays.
Tools
bitsadminsearch filters, such as searching for a current CVE. In the queries I used, I used the two words “bitsadmin” and “powershell” without leveraging a Shodan filter.cmd.exeattempt to download using cmd.exe to launch PowerShellFTPFile transfer protocol (FTP)NslookupWhile doing some additional research I came across screenshots for Nslookup. I found a variety of screenshots making Nslookup requests to a range of different IPs with one similarity.PowerShellsuch as searching for a current CVE. In the queries I used, I used the two words “bitsadmin” and “powershell” without leveraging a Shodan filter.